ThreatIntelIndicators

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index

Reference for ThreatIntelIndicators table in Azure Monitor Logs.

Attribute Value
Category Internal
Basic Logs Eligible ✓ Yes (source)
Supports Transformations ✓ Yes (source)
Ingestion API Supported ✓ Yes
Azure Monitor Tables Reference View Documentation
Azure Monitor Logs Ingestion API View Documentation

Contents

Schema (26 columns)

Source: Azure Monitor documentation

Column Name Type Description
_BilledSize real The record size in bytes
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
_ResourceId string A unique identifier for the resource that the record is associated with
_SubscriptionId string A unique identifier for the subscription that the record is associated with
AdditionalFields dynamic The type specifc fields that Sentinel adds. Contains the TLPLevel: white, green, amber, or red.
AzureTenantId string The tenant that submitted the indicator.
Confidence int The confidence that the creator has in the correctness of their data. The value must be a number in the range of 0-100.
Created datetime The date when the indicator was created.
Data dynamic All object properties, formatted according to the STIX specification (https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.pdf).
Id string A value that uniquely identifies the indicator STIX object. This value is usable with Sentinel APIs.
IsActive bool A value that specifies if an indicator is active and valid for detections.
IsDeleted bool A value that indicates whether the data was deleted from Sentinel or not.
LastUpdateMethod string The component that last updated the indicator.
Modified datetime The date when the indicator was modified.
ObservableKey string The entire left-hand side of an equality comparison from the pattern.
ObservableValue string The entire right-hand side of an equality comparison from the pattern.
Pattern string The detection pattern for this indicator MAY be expressed as a STIX pattern.
Revoked bool A value that specifies whether the indicator was revoked.
SourceSystem string The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
Tags string Sentinel defined tags for the indicator.
TenantId string The Log Analytics workspace ID
TimeGenerated datetime The time of indicator ingestion.
Type string The name of the table
ValidFrom datetime The time from which this indicator is considered a valid indicator of the behaviors it is related or represents.
ValidUntil datetime The time at which this indicator should no longer be considered a valid indicator of the bahviors it is related to or represents.
WorkspaceId string The workspace that submitted the indicator.

Solutions (15)

This table is used by the following solutions:

Connectors (9)

This table is ingested by the following connectors:

Connector Selection Criteria
CrowdStrike Falcon Adversary Intelligence
Cyjax Threat Intelligence IOC Connector
Lumen Defender Threat Feed Data Connector V2
Lumen Defender Threat Feed Data Connector V2 (using Azure Functions Flex Consumption Plan with Private Networking)
Microsoft Defender Threat Intelligence
Premium Microsoft Defender Threat Intelligence
Threat Intelligence Platforms
Threat intelligence - TAXII
Threat Intelligence Upload API (Preview)

Content Items Using This Table (105)

Analytic Rules (71)

In solution Global Secure Access:

Analytic Rule Selection Criteria
GSA - TI Domain Entity
GSA - TI IP Entity
GSA - TI URL Entity

In solution Google Threat Intelligence:

Analytic Rule Selection Criteria
Google Threat Intelligence - Threat Hunting Domain
Google Threat Intelligence - Threat Hunting Hash
Google Threat Intelligence - Threat Hunting IP
Google Threat Intelligence - Threat Hunting Url

In solution Lumen Defender Threat Feed:

Analytic Rule Selection Criteria
Lumen TI IPAddress in CommonSecurityLog
Lumen TI IPAddress in DeviceEvents
Lumen TI IPAddress in IdentityLogonEvents
Lumen TI IPAddress in OfficeActivity
Lumen TI IPAddress in SecurityEvents
Lumen TI IPAddress in SigninLogs
Lumen TI IPAddress in WindowsEvents
Lumen TI domain in DnsEvents

In solution Recorded Future:

Analytic Rule Selection Criteria
RecordedFuture Threat Hunting Domain All Actors
RecordedFuture Threat Hunting Hash All Actors
RecordedFuture Threat Hunting IP All Actors
RecordedFuture Threat Hunting Url All Actors

In solution Threat Intelligence (NEW):

Analytic Rule Selection Criteria
TI Map Domain Entity to DeviceNetworkEvents
TI Map IP Entity to Azure SQL Security Audit Events
TI Map IP Entity to AzureActivity
TI Map IP Entity to CommonSecurityLog
TI Map IP Entity to DeviceNetworkEvents
TI Map IP Entity to DnsEvents
TI Map IP Entity to Duo Security
TI Map IP Entity to SigninLogs
TI Map IP Entity to VMConnection
TI Map IP Entity to W3CIISLog
TI Map URL Entity to AuditLogs
TI Map URL Entity to DeviceNetworkEvents
TI Map URL Entity to EmailUrlInfo
TI Map URL Entity to PaloAlto Data
TI Map URL Entity to SecurityAlert Data
TI Map URL Entity to Syslog Data
TI Map URL Entity to UrlClickEvents
TI map Domain entity to Cloud App Events
TI map Domain entity to Dns Events (ASIM DNS Schema)
TI map Domain entity to DnsEvents
TI map Domain entity to EmailEvents
TI map Domain entity to EmailUrlInfo
TI map Domain entity to PaloAlto
TI map Domain entity to PaloAlto CommonSecurityLog
TI map Domain entity to SecurityAlert
TI map Domain entity to Syslog
TI map Domain entity to Web Session Events (ASIM Web Session schema)
TI map Email entity to AzureActivity
TI map Email entity to Cloud App Events
TI map Email entity to EmailEvents
TI map Email entity to OfficeActivity
TI map Email entity to PaloAlto CommonSecurityLog
TI map Email entity to SecurityAlert
TI map Email entity to SecurityEvent
TI map Email entity to SigninLogs
TI map File Hash to CommonSecurityLog Event
TI map File Hash to DeviceFileEvents Event
TI map File Hash to Security Event
TI map IP entity to AWSCloudTrail
TI map IP entity to AppServiceHTTPLogs
TI map IP entity to Azure Key Vault logs
TI map IP entity to AzureFirewall
TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)
TI map IP entity to Cloud App Events
TI map IP entity to DNS Events (ASIM DNS schema)
TI map IP entity to GitHub_CL
TI map IP entity to Network Session Events (ASIM Network Session schema)
TI map IP entity to OfficeActivity
TI map IP entity to Web Session Events (ASIM Web Session schema)
TI map IP entity to Workday(ASimAuditEventLogs)
TI map URL entity to Cloud App Events
TI map URL entity to Web Session Events (ASIM Web Session schema)

Hunting Queries (15)

In solution Google Threat Intelligence:

Hunting Query Selection Criteria
Google Threat Intelligence - Threat Hunting Domain
Google Threat Intelligence - Threat Hunting Hash
Google Threat Intelligence - Threat Hunting IP
Google Threat Intelligence - Threat Hunting Url

In solution Lumen Defender Threat Feed:

Hunting Query Selection Criteria
Lumen TI IPAddress indicator in CommonSecurityLog

In solution Recorded Future:

Hunting Query Selection Criteria
RecordedFuture Threat Hunting Domain All Actors
RecordedFuture Threat Hunting Hash All Actors
RecordedFuture Threat Hunting IP All Actors
RecordedFuture Threat Hunting URL All Actors

In solution Threat Intelligence (NEW):

Hunting Query Selection Criteria
TI Map File Entity to OfficeActivity Event
TI Map File Entity to Security Event
TI Map File Entity to Syslog Event
TI Map File Entity to VMConnection Event
TI Map File Entity to WireData Event

GitHub Only:

Hunting Query Selection Criteria
Teams Threat Intelligence Indicator Hit for Domain or URL

Workbooks (19)

In solution CiscoMeraki:

Workbook Selection Criteria
CiscoMerakiWorkbook

In solution CofenseTriage:

Workbook Selection Criteria
CofenseTriageThreatIndicators

In solution Cyjax:

Workbook Selection Criteria
Cyjax

In solution DNS Essentials:

Workbook Selection Criteria
DNSSolutionWorkbook

In solution DORA Compliance:

Workbook Selection Criteria
DORACompliance

In solution HIPAA Compliance:

Workbook Selection Criteria
HIPAACompliance

In solution Lumen Defender Threat Feed:

Workbook Selection Criteria
Lumen-Threat-Feed-Overview

In solution Recorded Future:

Workbook Selection Criteria
RecordedFutureDomainCorrelation
RecordedFutureHashCorrelation
RecordedFutureIPCorrelation
RecordedFutureURLCorrelation

In solution ReversingLabs:

Workbook Selection Criteria
ReversingLabs-CapabilitiesOverview

In solution Salesforce Service Cloud:

Workbook Selection Criteria
SalesforceServiceCloud

In solution Threat Intelligence (NEW):

Workbook Selection Criteria
ThreatIntelligenceNew

In solution ThreatConnect:

Workbook Selection Criteria
ThreatConnectOverview

GitHub Only:

Workbook Selection Criteria
IntsightsIOCWorkbook
InvestigationInsights
OptimizationWorkbook
ThreatIntelligence

Parsers Using This Table (3)

Other Parsers (3)

Parser Solution Selection Criteria
CyjaxCorrelate Cyjax
CyjaxThreatIndicator Cyjax
ThreatIntelIndicatorsv2 Threat Intelligence (NEW)

Resource Types

This table collects data from the following Azure resource types:

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index