Threat Intelligence Indicator - Append Tags

Service:

Sentinel

API Version:

2023-02-01

Append tags to a threat intelligence indicator.

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}/appendTags?api-version=2023-02-01

URI Parameters

Name	In	Required	Type	Description
name	path	True	string	Threat intelligence indicator name field.
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string minLength: 1	The ID of the target subscription.
workspaceName	path	True	string minLength: 1 maxLength: 90 pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$	The name of the workspace.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Request Body

Name	Type	Description
threatIntelligenceTags	string[]	List of tags to be appended.

Responses

Name	Type	Description
200 OK		OK
Other Status Codes	CloudError	Error response describing why the operation failed to append tags.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Append tags to a threat intelligence indicator

Sample request

HTTP

POST https://management.azure.com/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/d9cd6f0b-96b9-3984-17cd-a779d1e15a93/appendTags?api-version=2023-02-01

{
  "threatIntelligenceTags": [
    "tag1",
    "tag2"
  ]
}

Sample response

Status code:

200

Definitions

Name	Description
CloudError	Error response structure.
CloudErrorBody	Error details.
ThreatIntelligenceAppendTags	Array of tags to be appended to the threat intelligence indicator.

CloudError

Object

Error response structure.

Name	Type	Description
error	CloudErrorBody	Error data

CloudErrorBody

Object

Error details.

Name	Type	Description
code	string	An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message	string	A message describing the error, intended to be suitable for display in a user interface.

ThreatIntelligenceAppendTags

Object

Array of tags to be appended to the threat intelligence indicator.

Name	Type	Description
threatIntelligenceTags	string[]	List of tags to be appended.