Modifica

Condividi tramite

intelligenceProfileIndicator resource type

  • Articolo

Namespace: microsoft.graph.security

Note

The Microsoft Graph API for Microsoft Defender Threat Intelligence requires an active Defender Threat Intelligence Portal license and API add-on license for the tenant.

Represents an indicator of threat or compromise related to the contents of an intelligenceProfile.

The relationship from an intelligenceProfileIndicator to an artifact provides the means for threat intelligence API users to further evaluate details about reported indicator.

Inherits from microsoft.graph.security.indicator.

Methods

Method Return type Description
Get intelligence profile indicator microsoft.graph.security.intelligenceProfileIndicator Read the properties and relationships of a microsoft.graph.security.intelligenceProfileIndicator object.

Properties

Property Type Description
firstSeenDateTime DateTimeOffset Designate when an artifact was first used actively in an attack, when a particular sample was compiled, or if neither of those could be ascertained when the file was first seen in public repositories (for example, VirusTotal, ANY.RUN, Hybrid Analysis) or reported publicly.
id String A system generated ID for this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator.
lastSeenDateTime DateTimeOffset Designate when an artifact was most recently used actively in an attack, when a particular sample was compiled, or if neither of those could be ascertained when the file was first seen in public repositories (for example, VirusTotal, ANY.RUN, Hybrid Analysis) or reported publicly.
source microsoft.graph.security.indicatorSource Communicates the source of this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator. The possible values are: microsoft, osint, public, unknownFutureValue.

Relationships

Relationship Type Description
artifact microsoft.graph.security.artifact The artifact that is reported in this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.intelligenceProfileIndicator",
  "firstSeenDateTime": "String (timestamp)",
  "id": "String (identifier)",
  "lastSeenDateTime": "String (timestamp)",
  "source": "String"
}