intelligenceProfileIndicator resource type
Namespace: microsoft.graph.security
Note
The Microsoft Graph API for Microsoft Defender Threat Intelligence requires an active Defender Threat Intelligence Portal license and API add-on license for the tenant.
Represents an indicator of threat or compromise related to the contents of an intelligenceProfile.
The relationship from an intelligenceProfileIndicator to an artifact provides the means for threat intelligence API users to further evaluate details about reported indicator.
Inherits from microsoft.graph.security.indicator.
Methods
Method | Return type | Description |
---|---|---|
Get intelligenceProfileIndicator | microsoft.graph.security.intelligenceProfileIndicator | Read the properties and relationships of a microsoft.graph.security.intelligenceProfileIndicator object. |
Properties
Property | Type | Description |
---|---|---|
firstSeenDateTime | DateTimeOffset | Designate when an artifact was first used actively in an attack, when a particular sample was compiled, or if neither of those could be ascertained when the file was first seen in public repositories (for example, VirusTotal, ANY.RUN, Hybrid Analysis) or reported publicly. |
id | String | A system generated ID for this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator. |
lastSeenDateTime | DateTimeOffset | Designate when an artifact was most recently used actively in an attack, when a particular sample was compiled, or if neither of those could be ascertained when the file was first seen in public repositories (for example, VirusTotal, ANY.RUN, Hybrid Analysis) or reported publicly. |
source | microsoft.graph.security.indicatorSource | Communicates the source of this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator. The possible values are: microsoft , osint , public , unknownFutureValue . |
Relationships
Relationship | Type | Description |
---|---|---|
artifact | microsoft.graph.security.artifact | The artifact that is reported in this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator. |
JSON representation
The following is a JSON representation of the resource.
{
"@odata.type": "#microsoft.graph.security.intelligenceProfileIndicator",
"firstSeenDateTime": "String (timestamp)",
"id": "String (identifier)",
"lastSeenDateTime": "String (timestamp)",
"source": "String"
}
Feedback
https://aka.ms/ContentUserFeedback.
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see:Submit and view feedback for