threat_intelligence

Creates, updates, deletes, gets or lists a threat_intelligence resource.

Overview

Name	threat_intelligence
Type	Resource
Id	azure.security_insight.threat_intelligence

Fields

The following fields are returned by SELECT queries:

query

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
createdBy	object	The UserInfo of the user/entity which originally created this TI object.
data	object	The core STIX object that this TI object represents.
firstIngestedTimeUtc	string (date-time)	The timestamp for the first time this object was ingested.
ingestionRulesVersion	string	The ID of the rules version that was active when this TI object was last ingested.
kind	string	The kind of the TI object. Required. Known values are: "AttackPattern", "Identity", "Indicator", "Relationship", and "ThreatActor".
lastIngestedTimeUtc	string (date-time)	The timestamp for the last time this object was ingested.
lastModifiedBy	object	The UserInfo of the user/entity which last modified this TI object.
lastUpdateMethod	string	The name of the method/application that initiated the last write to this TI object.
lastUpdatedDateTimeUtc	string (date-time)	The timestamp for the last time this TI object was updated.
relationshipHints	array	A dictionary used to help follow relationships from this object to other STIX objects. The keys are field names from the STIX object (in the 'data' field), and the values are lists of sources that can be prepended to the object ID in order to efficiently locate the target TI object.
source	string	The source name for this TI object.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
query	select	resource_group_name, workspace_name, ti_type, subscription_id		Gets all TI objects for the workspace.
count	exec	resource_group_name, workspace_name, ti_type, subscription_id		Gets the count of all TI objects for the workspace.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
ti_type	string	TI type. "main" Required.
workspace_name	string	The name of the workspace. Required.

SELECT examples

query

Gets all TI objects for the workspace.

SELECT
id,
name,
createdBy,
data,
firstIngestedTimeUtc,
ingestionRulesVersion,
kind,
lastIngestedTimeUtc,
lastModifiedBy,
lastUpdateMethod,
lastUpdatedDateTimeUtc,
relationshipHints,
source,
systemData,
type
FROM azure.security_insight.threat_intelligence
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND ti_type = '{{ ti_type }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

Lifecycle Methods

count

Gets the count of all TI objects for the workspace.

EXEC azure.security_insight.threat_intelligence.count 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@ti_type='{{ ti_type }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"properties": "{{ properties }}"
}'
;