Microsoft Defender for Endpoint Indicators API
The Microsoft Defender for Endpoint indicators API manages custom indicators of compromise for endpoint enforcement and alerting, including batch import for custom threat intelligence ingestion into Defender for Endpoint.
apisCurrent
Relationships
No related entities recorded yet.
Example Request
http
POST https://api.security.microsoft.com/api/indicators/import
Authorization: Bearer <token>
Content-Type: application/json
{"Indicators":[{"indicatorValue":"203.0.113.10","indicatorType":"IpAddress","title":"Custom TI indicator","application":"custom-tip","expirationTime":"2026-12-31T00:00:00Z","action":"Alert","severity":"Medium"}]}