api

Microsoft Sentinel Threat Intelligence Upload API

The Microsoft Sentinel threat intelligence upload API imports custom threat intelligence STIX objects, including indicators, attack patterns, threat actors, identities, and relationships, into a Sentinel workspace without requiring a data connector.

apisCurrent

Relationships

ThreatIntelIndicators
Exposed tabletableThreatIntelObjects
Exposed tabletable

Example Request

http
POST https://api.ti.sentinel.azure.com/workspaces/{workspaceId}/threat-intelligence-stix-objects:upload?api-version=2024-02-01-preview
Authorization: Bearer <token>
Content-Type: application/json

{"sourcesystem":"custom-tip","stixobjects":[{"type":"indicator","spec_version":"2.1","id":"indicator--<uuid>","created":"2026-08-11T00:00:00Z","modified":"2026-08-11T00:00:00Z","pattern":"[ipv4-addr:value = '203.0.113.10']","pattern_type":"stix","valid_from":"2026-08-11T00:00:00Z"}]}