intelligenceProfileIndicator resource type
Namespace: microsoft.graph.security
Important
APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
Note
The Microsoft Graph API for Microsoft Defender Threat Intelligence requires an active Defender Threat Intelligence Portal license and API add-on license for the tenant.
Represents an indicator of threat or compromise related to the contents of an intelligenceProfile.
The relationship from an intelligenceProfileIndicator to an artifact provides the means for threat intelligence API users to further evaluate details about reported indicator.
Inherits from microsoft.graph.security.indicator.
Methods
| Method | Return type | Description |
|---|---|---|
| Get intelligence profile indicator | microsoft.graph.security.intelligenceProfileIndicator | Read the properties and relationships of a microsoft.graph.security.intelligenceProfileIndicator object. |
Properties
| Property | Type | Description |
|---|---|---|
| firstSeenDateTime | DateTimeOffset | Designate when an artifact was first used actively in an attack, when a particular sample was compiled, or if neither of those could be ascertained when the file was first seen in public repositories (for example, VirusTotal, ANY.RUN, Hybrid Analysis) or reported publicly. |
| id | String | A system generated ID for this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator. |
| lastSeenDateTime | DateTimeOffset | Designate when an artifact was most recently used actively in an attack, when a particular sample was compiled, or if neither of those could be ascertained when the file was first seen in public repositories (for example, VirusTotal, ANY.RUN, Hybrid Analysis) or reported publicly. |
| source | microsoft.graph.security.indicatorSource | Communicates the source of this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator. The possible values are: microsoftDefenderThreatIntelligence, openSourceIntelligence, public, unknownFutureValue. |
Relationships
| Relationship | Type | Description |
|---|---|---|
| artifact | microsoft.graph.security.artifact | The artifact that is reported in this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator. |
JSON representation
The following JSON representation shows the resource type.
{
"@odata.type": "#microsoft.graph.security.intelligenceProfileIndicator",
"firstSeenDateTime": "String (timestamp)",
"id": "String (identifier)",
"lastSeenDateTime": "String (timestamp)",
"source": "String"
}