threat_intelligence_indicator

Creates, updates, deletes, gets or lists a threat_intelligence_indicator resource.

Overview

Name	threat_intelligence_indicator
Type	Resource
Id	azure.security_insight.threat_intelligence_indicator

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
etag	string	Etag of the azure resource.
kind	string	Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type. If supported, the resource provider must validate and persist this value. Required. "indicator"
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

query_indicators

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
etag	string	Etag of the azure resource.
kind	string	Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type. If supported, the resource provider must validate and persist this value. Required. "indicator"
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, name, subscription_id		View a threat intelligence indicator by name.
query_indicators	select	resource_group_name, workspace_name, subscription_id		Query threat intelligence indicators as per filtering criteria.
create	insert	resource_group_name, workspace_name, name, subscription_id, kind		Update a threat Intelligence indicator.
delete	delete	resource_group_name, workspace_name, name, subscription_id		Delete a threat intelligence indicator.
append_tags	exec	resource_group_name, workspace_name, name, subscription_id		Append tags to a threat intelligence indicator.
replace_tags	exec	resource_group_name, workspace_name, name, subscription_id, kind		Replace tags added to a threat intelligence indicator.
create_indicator	exec	resource_group_name, workspace_name, subscription_id, kind		Create a new threat intelligence indicator.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
name	string	Threat intelligence indicator name field. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
workspace_name	string	The name of the monitor workspace. Required.

SELECT examples

get

View a threat intelligence indicator by name.

SELECT
id,
name,
etag,
kind,
systemData,
type
FROM azure.security_insight.threat_intelligence_indicator
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND name = '{{ name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

query_indicators

Query threat intelligence indicators as per filtering criteria.

SELECT
id,
name,
etag,
kind,
systemData,
type
FROM azure.security_insight.threat_intelligence_indicator
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

INSERT examples

create

Update a threat Intelligence indicator.

INSERT INTO azure.security_insight.threat_intelligence_indicator (
kind,
etag,
properties,
resource_group_name,
workspace_name,
name,
subscription_id
)
SELECT 
'{{ kind }}' /* required */,
'{{ etag }}',
'{{ properties }}',
'{{ resource_group_name }}',
'{{ workspace_name }}',
'{{ name }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
kind,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: threat_intelligence_indicator
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the threat_intelligence_indicator resource.
  - name: workspace_name
    value: "{{ workspace_name }}"
    description: Required parameter for the threat_intelligence_indicator resource.
  - name: name
    value: "{{ name }}"
    description: Required parameter for the threat_intelligence_indicator resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the threat_intelligence_indicator resource.
  - name: kind
    value: "{{ kind }}"
    description: |
      Required. Entity represents threat intelligence indicator in the system.
  - name: etag
    value: "{{ etag }}"
    description: |
      Etag of the azure resource.
  - name: properties
    description: |
      Threat Intelligence Entity properties.
    value:
      additionalData: "{{ additionalData }}"
      friendlyName: "{{ friendlyName }}"
      threatIntelligenceTags:
        - "{{ threatIntelligenceTags }}"
      lastUpdatedTimeUtc: "{{ lastUpdatedTimeUtc }}"
      source: "{{ source }}"
      displayName: "{{ displayName }}"
      description: "{{ description }}"
      indicatorTypes:
        - "{{ indicatorTypes }}"
      pattern: "{{ pattern }}"
      patternType: "{{ patternType }}"
      patternVersion: "{{ patternVersion }}"
      killChainPhases:
        - killChainName: "{{ killChainName }}"
          phaseName: "{{ phaseName }}"
      parsedPattern:
        - patternTypeKey: "{{ patternTypeKey }}"
          patternTypeValues: "{{ patternTypeValues }}"
      externalId: "{{ externalId }}"
      createdByRef: "{{ createdByRef }}"
      defanged: {{ defanged }}
      externalLastUpdatedTimeUtc: "{{ externalLastUpdatedTimeUtc }}"
      externalReferences:
        - description: "{{ description }}"
          externalId: "{{ externalId }}"
          sourceName: "{{ sourceName }}"
          url: "{{ url }}"
          hashes: "{{ hashes }}"
      granularMarkings:
        - language: "{{ language }}"
          markingRef: {{ markingRef }}
          selectors: "{{ selectors }}"
      labels:
        - "{{ labels }}"
      revoked: {{ revoked }}
      confidence: {{ confidence }}
      objectMarkingRefs:
        - "{{ objectMarkingRefs }}"
      language: "{{ language }}"
      threatTypes:
        - "{{ threatTypes }}"
      validFrom: "{{ validFrom }}"
      validUntil: "{{ validUntil }}"
      created: "{{ created }}"
      modified: "{{ modified }}"
      extensions: "{{ extensions }}"

DELETE examples

delete

Delete a threat intelligence indicator.

DELETE FROM azure.security_insight.threat_intelligence_indicator
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND name = '{{ name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;

Lifecycle Methods

append_tags

Append tags to a threat intelligence indicator.

EXEC azure.security_insight.threat_intelligence_indicator.append_tags 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@name='{{ name }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"threatIntelligenceTags": "{{ threatIntelligenceTags }}"
}'
;

replace_tags

Replace tags added to a threat intelligence indicator.

EXEC azure.security_insight.threat_intelligence_indicator.replace_tags 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@name='{{ name }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"kind": "{{ kind }}", 
"etag": "{{ etag }}", 
"properties": "{{ properties }}"
}'
;

create_indicator

Create a new threat intelligence indicator.

EXEC azure.security_insight.threat_intelligence_indicator.create_indicator 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"kind": "{{ kind }}", 
"etag": "{{ etag }}", 
"properties": "{{ properties }}"
}'
;