api

Microsoft Sentinel Threat Intelligence Upload API

The Microsoft Sentinel threat intelligence upload API imports custom threat intelligence STIX objects, including indicators, attack patterns, threat actors, identities, and relationships, into a Sentinel workspace without requiring a data connector.

apisCurrent

Relationships

ThreatIntelIndicators
Exposed tabletableThreatIntelObjects
Exposed tabletable

Related KQL

Join active threat indicators to endpoint network events

Use active IP indicators from Sentinel threat intelligence to find matching endpoint network connections.

template
advancedthreat-intelligenceendpoint
Run surface
Sentinel Logs
Required tables
ThreatIntelIndicatorsDeviceNetworkEvents
License context
Microsoft Defender for Endpoint P2
kql
let lookback = {lookback};
let activeIndicators = ThreatIntelIndicators
| where TimeGenerated > ago(30d)
| where Active == true
| where isnotempty(NetworkIP)
| summarize arg_max(TimeGenerated, *) by NetworkIP
| project IndicatorIP=NetworkIP, ThreatType, ConfidenceScore, Description, IndicatorSource=SourceSystem;
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where isnotempty(RemoteIP)
| join kind=inner activeIndicators on $left.RemoteIP == $right.IndicatorIP
| project Timestamp, DeviceName, InitiatingProcessAccountUpn, RemoteIP, RemoteUrl, InitiatingProcessFileName, ThreatType, ConfidenceScore, IndicatorSource, Description
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 3: Advanced KQL/Query Samples. Adapted from join and threat-intelligence pivot patterns for modeled Sentinel and MDE tables.

Example Request

http
POST https://api.ti.sentinel.azure.com/workspaces/{workspaceId}/threat-intelligence-stix-objects:upload?api-version=2024-02-01-preview
Authorization: Bearer <token>
Content-Type: application/json

{"sourcesystem":"custom-tip","stixobjects":[{"type":"indicator","spec_version":"2.1","id":"indicator--<uuid>","created":"2026-08-11T00:00:00Z","modified":"2026-08-11T00:00:00Z","pattern":"[ipv4-addr:value = '203.0.113.10']","pattern_type":"stix","valid_from":"2026-08-11T00:00:00Z"}]}