ThreatIntelIndicators

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Reference for ThreatIntelIndicators table in Azure Monitor Logs.

Attribute Value
Category Internal
Basic Logs Eligible ✓ Yes (source)
Supports Transformations ✓ Yes (source)
Ingestion API Supported ✓ Yes
Lake-Only Ingestion ✗ No (source)
Azure Monitor Tables Reference View Documentation
Azure Monitor Logs Ingestion API View Documentation

Contents

Schema (26 columns)

Source: Azure Monitor documentation

Column Name Type Description
_BilledSize real The record size in bytes
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
_ResourceId string A unique identifier for the resource that the record is associated with
_SubscriptionId string A unique identifier for the subscription that the record is associated with
AdditionalFields dynamic The type specifc fields that Sentinel adds. Contains the TLPLevel: white, green, amber, or red.
AzureTenantId string The tenant that submitted the indicator.
Confidence int The confidence that the creator has in the correctness of their data. The value must be a number in the range of 0-100.
Created datetime The date when the indicator was created.
Data dynamic All object properties, formatted according to the STIX specification (https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.pdf).
Id string A value that uniquely identifies the indicator STIX object. This value is usable with Sentinel APIs.
IsActive bool A value that specifies if an indicator is active and valid for detections.
IsDeleted bool A value that indicates whether the data was deleted from Sentinel or not.
LastUpdateMethod string The component that last updated the indicator.
Modified datetime The date when the indicator was modified.
ObservableKey string The entire left-hand side of an equality comparison from the pattern.
ObservableValue string The entire right-hand side of an equality comparison from the pattern.
Pattern string The detection pattern for this indicator MAY be expressed as a STIX pattern.
Revoked bool A value that specifies whether the indicator was revoked.
SourceSystem string The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
Tags string Sentinel defined tags for the indicator.
TenantId string The Log Analytics workspace ID
TimeGenerated datetime The time of indicator ingestion.
Type string The name of the table
ValidFrom datetime The time from which this indicator is considered a valid indicator of the behaviors it is related or represents.
ValidUntil datetime The time at which this indicator should no longer be considered a valid indicator of the bahviors it is related to or represents.
WorkspaceId string The workspace that submitted the indicator.

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (26)

This table is used by the following solutions:

Connectors (16)

This table is ingested by the following connectors:

Connector Selection Criteria
CrowdStrike Falcon Adversary Intelligence SourceSystem == "CrowdStrike Falcon Adversary Intelligence"
Cyjax Threat Intelligence IOC Connector SourceSystem == "Cyjax-IOCs"
Datalake2Sentinel
Feedly IoC ObservableKey in "domain-name:value,ipv4-addr:value,url:value"
SourceSystem == "Feedly"
GreyNoise Threat Intelligence SourceSystem == "GreyNoise"
Infoblox Data Connector via REST API
JoeSandboxThreatIntelligence
Lumen Defender Threat Feed Data Connector V2 ObservableKey in "domain-name:value,ipv4-addr:value"
SourceSystem == "Lumen"
Lumen Defender Threat Feed Data Connector V2 (using Azure Functions Flex Consumption Plan with Private Networking) ObservableKey in "domain-name:value,ipv4-addr:value"
SourceSystem == "Lumen"
MISP2Sentinel SourceSystem == "MISP"
Microsoft Defender Threat Intelligence
PRODAFT USTA - IoC Threat Intelligence SourceSystem startswith "PRODAFT USTA"
Threat Intelligence Platforms
Threat intelligence - TAXII
Threat Intelligence Upload API (Preview)
VMRayThreatIntelligence

Content Items Using This Table (127)

Analytic Rules (79)

In solution Datazag:

Analytic Rule Selection Criteria
Datazag - impersonation domain resolved in DNS

In solution Global Secure Access:

Analytic Rule Selection Criteria
GSA - TI Domain Entity
GSA - TI IP Entity
GSA - TI URL Entity

In solution Google Threat Intelligence:

Analytic Rule Selection Criteria
Google Threat Intelligence - Threat Hunting Domain ObservableKey == "domain-name:value"
SourceSystem == "Google Threat Intelligence"
Google Threat Intelligence - Threat Hunting Hash ObservableKey contains "file:hashes"
SourceSystem == "Google Threat Intelligence"
Google Threat Intelligence - Threat Hunting IP ObservableKey == "ipv4-addr:value"
SourceSystem == "Google Threat Intelligence"
Google Threat Intelligence - Threat Hunting Url ObservableKey == "url:value"
SourceSystem == "Google Threat Intelligence"

In solution HoneyLabs:

Analytic Rule Selection Criteria
HoneyLabs TI Map IP Entity to CommonSecurityLog
HoneyLabs TI Map IP Entity to Network Session (ASIM)
HoneyLabs TI Map IP Entity to SigninLogs
HoneyLabs TI Map URL Entity to CommonSecurityLog

In solution Lumen Defender Threat Feed:

Analytic Rule Selection Criteria
Lumen TI IPAddress in CommonSecurityLog
Lumen TI IPAddress in DeviceEvents
Lumen TI IPAddress in IdentityLogonEvents
Lumen TI IPAddress in OfficeActivity
Lumen TI IPAddress in SecurityEvents
Lumen TI IPAddress in SigninLogs
Lumen TI IPAddress in WindowsEvents
Lumen TI domain in DnsEvents

In solution PRODAFT USTA - IoC Threat Intelligence:

Analytic Rule Selection Criteria
PRODAFT USTA - TI map Domain to DnsEvents
PRODAFT USTA - TI map File Hash to CommonSecurityLog
PRODAFT USTA - TI map URL to Syslog

In solution Recorded Future:

Analytic Rule Selection Criteria
RecordedFuture Threat Hunting Domain All Actors ObservableKey == "domain-name:value"
RecordedFuture Threat Hunting Hash All Actors
RecordedFuture Threat Hunting IP All Actors ObservableKey == "ipv4-addr:value"
RecordedFuture Threat Hunting Url All Actors ObservableKey == "url:value"

In solution Threat Intelligence (NEW):

Analytic Rule Selection Criteria
TI Map Domain Entity to DeviceNetworkEvents
TI Map Domain entity to Cloud App Events
TI Map Domain entity to Dns Events (ASIM DNS Schema)
TI Map Domain entity to DnsEvents
TI Map Domain entity to EmailEvents
TI Map Domain entity to EmailUrlInfo
TI Map Domain entity to PaloAlto
TI Map Domain entity to PaloAlto CommonSecurityLog
TI Map Domain entity to SecurityAlert
TI Map Domain entity to Syslog
TI Map Domain entity to Web Session Events (ASIM Web Session schema)
TI Map Email entity to AzureActivity
TI Map Email entity to Cloud App Events
TI Map Email entity to EmailEvents
TI Map Email entity to OfficeActivity
TI Map Email entity to PaloAlto CommonSecurityLog
TI Map Email entity to SecurityAlert
TI Map Email entity to SecurityEvent
TI Map Email entity to SigninLogs
TI Map File Hash to CommonSecurityLog Event
TI Map File Hash to DeviceFileEvents Event
TI Map File Hash to Security Event
TI Map IP Entity to Azure SQL Security Audit Events
TI Map IP Entity to AzureActivity
TI Map IP Entity to CommonSecurityLog
TI Map IP Entity to DeviceNetworkEvents
TI Map IP Entity to DnsEvents
TI Map IP Entity to Duo Security
TI Map IP Entity to SigninLogs
TI Map IP Entity to VMConnection
TI Map IP Entity to W3CIISLog
TI Map IP entity to AWSCloudTrail
TI Map IP entity to AppServiceHTTPLogs
TI Map IP entity to Azure Key Vault logs
TI Map IP entity to AzureFirewall
TI Map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)
TI Map IP entity to Cloud App Events
TI Map IP entity to DNS Events (ASIM DNS schema)
TI Map IP entity to GitHub_CL
TI Map IP entity to Network Session Events (ASIM Network Session schema)
TI Map IP entity to OfficeActivity
TI Map IP entity to Web Session Events (ASIM Web Session schema)
TI Map IP entity to Workday(ASimAuditEventLogs)
TI Map URL Entity to AuditLogs
TI Map URL Entity to DeviceNetworkEvents
TI Map URL Entity to EmailUrlInfo
TI Map URL Entity to PaloAlto Data
TI Map URL Entity to SecurityAlert Data
TI Map URL Entity to Syslog Data
TI Map URL Entity to UrlClickEvents
TI Map URL entity to Cloud App Events
TI Map URL entity to Web Session Events (ASIM Web Session schema)

Hunting Queries (22)

In solution Datazag:

Hunting Query Selection Criteria
Datazag - retro-hunt historical DNS against impersonation indicators

In solution Google Threat Intelligence:

Hunting Query Selection Criteria
Google Threat Intelligence - Threat Hunting Domain ObservableKey == "domain-name:value"
SourceSystem == "Google Threat Intelligence"
Google Threat Intelligence - Threat Hunting Hash ObservableKey contains "file:hashes"
SourceSystem == "Google Threat Intelligence"
Google Threat Intelligence - Threat Hunting IP ObservableKey == "ipv4-addr:value"
SourceSystem == "Google Threat Intelligence"
Google Threat Intelligence - Threat Hunting Url ObservableKey == "url:value"
SourceSystem == "Google Threat Intelligence"

In solution HoneyLabs:

Hunting Query Selection Criteria
Contact from a source probing a specific CVE
HoneyLabs high-confidence indicator seen for the first time
One HoneyLabs indicator contacting several internal hosts
Outbound contact with a HoneyLabs malware loader or C2 URL

In solution Hybrid Attack - Cloud & Identity:

Hunting Query Selection Criteria
Multi-Mailbox Access by Single IP via Cloud App Permissions ObservableKey == "ipv4-addr:value"
Threat Intelligence Matched IP on Network Appliance Traffic

In solution Lumen Defender Threat Feed:

Hunting Query Selection Criteria
Lumen TI IPAddress indicator in CommonSecurityLog

In solution Recorded Future:

Hunting Query Selection Criteria
RecordedFuture Threat Hunting Domain All Actors ObservableKey == "domain-name:value"
RecordedFuture Threat Hunting Hash All Actors ObservableKey contains "file:hashes"
RecordedFuture Threat Hunting IP All Actors ObservableKey == "ipv4-addr:value"
RecordedFuture Threat Hunting URL All Actors ObservableKey == "url:value"

In solution Threat Intelligence (NEW):

Hunting Query Selection Criteria
TI Map File Entity to OfficeActivity Event
TI Map File Entity to Security Event
TI Map File Entity to Syslog Event
TI Map File Entity to VMConnection Event
TI Map File Entity to WireData Event

GitHub Only:

Hunting Query Selection Criteria
Teams Threat Intelligence Indicator Hit for Domain or URL

Workbooks (23)

In solution CiscoMeraki:

Workbook Selection Criteria
CiscoMerakiWorkbook

In solution CofenseTriage:

Workbook Selection Criteria
CofenseTriageThreatIndicators

In solution Cyjax:

Workbook Selection Criteria
Cyjax

In solution DNS Essentials:

Workbook Selection Criteria
DNSSolutionWorkbook

In solution DORA Compliance: ObservableKey contains "file:hashes."
ObservableKey contains "network-traffic"

Workbook
DORACompliance

In solution GreyNoiseThreatIntelligence: SourceSystem == "GreyNoise"

Workbook
GreyNoiseOverview

In solution HIPAA Compliance:

Workbook Selection Criteria
HIPAACompliance

In solution HoneyLabs: ObservableKey == "ipv4-addr:value"
SourceSystem startswith "HoneyLabs"

Workbook
HoneyLabsThreatIntelligence

In solution Hybrid Attack - Cloud & Identity: ObservableKey == "ipv4-addr:value"

Workbook
HybridAttack-Cloud&Identity

In solution Lumen Defender Threat Feed:

Workbook Selection Criteria
Lumen-Threat-Feed-Overview

In solution PRODAFT USTA - IoC Threat Intelligence: SourceSystem startswith "PRODAFT USTA"

Workbook
PRODAFTUstaIoCOverview

In solution Recorded Future:

Workbook Selection Criteria
RecordedFutureDomainCorrelation ObservableKey == "domain-name:value"
RecordedFutureHashCorrelation
RecordedFutureIPCorrelation ObservableKey == "ipv4-addr:value"
RecordedFutureURLCorrelation ObservableKey == "url:value"

In solution ReversingLabs:

Workbook Selection Criteria
ReversingLabs-CapabilitiesOverview

In solution Salesforce Service Cloud:

Workbook Selection Criteria
SalesforceServiceCloud

In solution Threat Intelligence (NEW):

Workbook Selection Criteria
ThreatIntelligenceNew

In solution ThreatConnect:

Workbook Selection Criteria
ThreatConnectOverview

GitHub Only:

Workbook Selection Criteria
IntsightsIOCWorkbook
InvestigationInsights
OptimizationWorkbook
ThreatIntelligence

Parsers Using This Table (4)

Other Parsers (4)

Parser Solution Selection Criteria
Cyble Threat Intelligence Parser (Legacy)
CyjaxCorrelate Cyjax
CyjaxThreatIndicator Cyjax
ThreatIntelIndicatorsv2 Threat Intelligence (NEW)

Resource Types

This table collects data from the following Azure resource types:

Selection Criteria Summary (17 criteria, 32 total references)

References by type: 8 connectors, 24 content items, 0 ASIM parsers, 0 other parsers.

Selection Criteria Connectors Content Items ASIM Parsers Other Parsers Total
ObservableKey == "ipv4-addr:value" - 5 - - 5
ObservableKey == "domain-name:value" - 3 - - 3
ObservableKey == "url:value" - 3 - - 3
ObservableKey in "domain-name:value,ipv4-addr:value"
SourceSystem == "Lumen"		 2 - - - 2
SourceSystem == "GreyNoise" 1 1 - - 2
SourceSystem startswith "PRODAFT USTA" 1 1 - - 2
ObservableKey == "domain-name:value"
SourceSystem == "Google Threat Intelligence"		 - 2 - - 2
ObservableKey contains "file:hashes"
SourceSystem == "Google Threat Intelligence"		 - 2 - - 2
ObservableKey == "ipv4-addr:value"
SourceSystem == "Google Threat Intelligence"		 - 2 - - 2
ObservableKey == "url:value"
SourceSystem == "Google Threat Intelligence"		 - 2 - - 2
ObservableKey in "domain-name:value,ipv4-addr:value,url:value"
SourceSystem == "Feedly"		 1 - - - 1
SourceSystem == "Cyjax-IOCs" 1 - - - 1
SourceSystem == "MISP" 1 - - - 1
SourceSystem == "CrowdStrike Falcon Adversary Intelligence" 1 - - - 1
ObservableKey contains "file:hashes" - 1 - - 1
ObservableKey contains "file:hashes."
ObservableKey contains "network-traffic"		 - 1 - - 1
ObservableKey == "ipv4-addr:value"
SourceSystem startswith "HoneyLabs"		 - 1 - - 1
Total 8 24 0 0 32

ObservableKey

Value Connectors Content Items ASIM Parsers Other Parsers Total
ipv4-addr:value 3 8 - - 11
domain-name:value 3 5 - - 8
url:value 1 5 - - 6
contains file:hashes - 3 - - 3
contains file:hashes. - 1 - - 1
contains network-traffic - 1 - - 1

SourceSystem

Value Connectors Content Items ASIM Parsers Other Parsers Total
Google Threat Intelligence - 8 - - 8
Lumen 2 - - - 2
GreyNoise 1 1 - - 2
startswith PRODAFT USTA 1 1 - - 2
Feedly 1 - - - 1
Cyjax-IOCs 1 - - - 1
MISP 1 - - - 1
CrowdStrike Falcon Adversary Intelligence 1 - - - 1
startswith HoneyLabs - 1 - - 1

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index