intelligenceProfileIndicator resource type

Namespace: microsoft.graph.security

Note

The Microsoft Graph API for Microsoft Defender Threat Intelligence requires an active Defender Threat Intelligence Portal license and API add-on license for the tenant.

Represents an indicator of threat or compromise related to the contents of an intelligenceProfile.

The relationship from an intelligenceProfileIndicator to an artifact provides the means for threat intelligence API users to further evaluate details about reported indicator.

Inherits from microsoft.graph.security.indicator.

Methods

Method	Return type	Description
Get intelligenceProfileIndicator	microsoft.graph.security.intelligenceProfileIndicator	Read the properties and relationships of a microsoft.graph.security.intelligenceProfileIndicator object.

Properties

Property	Type	Description
firstSeenDateTime	DateTimeOffset	Designate when an artifact was first used actively in an attack, when a particular sample was compiled, or if neither of those could be ascertained when the file was first seen in public repositories (for example, VirusTotal, ANY.RUN, Hybrid Analysis) or reported publicly.
id	String	A system generated ID for this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator.
lastSeenDateTime	DateTimeOffset	Designate when an artifact was most recently used actively in an attack, when a particular sample was compiled, or if neither of those could be ascertained when the file was first seen in public repositories (for example, VirusTotal, ANY.RUN, Hybrid Analysis) or reported publicly.
source	microsoft.graph.security.indicatorSource	Communicates the source of this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator. The possible values are: microsoft, osint, public, unknownFutureValue.

Relationships

Relationship	Type	Description
artifact	microsoft.graph.security.artifact	The artifact that is reported in this intelligenceProfileIndicator. Inherited from microsoft.graph.security.indicator.

JSON representation

The following is a JSON representation of the resource.

{
  "@odata.type": "#microsoft.graph.security.intelligenceProfileIndicator",
  "firstSeenDateTime": "String (timestamp)",
  "id": "String (identifier)",
  "lastSeenDateTime": "String (timestamp)",
  "source": "String"
}