table

ThreatIntelIndicators

ThreatIntelIndicators stores Microsoft Sentinel STIX indicator records for threat intelligence imported through connectors, manual additions, or the upload API.

tablesCurrent

Relationships

Microsoft Sentinel
Source productproduct Microsoft Sentinel Threat Intelligence Upload API
API accessapi Microsoft Sentinel REST API
API accessapi ThreatIntelObjects
Related tabletable

Schema

Field	Type	Description
`AdditionalFields`	dynamic	Type-specific fields that Sentinel adds, including TLP level.
`AzureTenantId`	string	Tenant that submitted the indicator.
`_BilledSize`	real	Record size in bytes.
`Confidence`	int	Creator confidence in the correctness of the indicator, from 0 to 100.
`Created`	datetime	Date and time when the indicator was created.
`Data`	dynamic	All STIX object properties for the indicator.
`Id`	string	Unique identifier for the indicator STIX object, usable with Sentinel APIs.
`IsActive`	bool	Indicates whether the indicator is active and valid for detections.
`_IsBillable`	string	Specifies whether ingestion is billable.
`IsDeleted`	bool	Indicates whether the indicator was deleted from Sentinel.
`LastUpdateMethod`	string	Component that last updated the indicator.
`Modified`	datetime	Date and time when the indicator was modified.
`ObservableKey`	string	Left-hand side of an equality comparison from the STIX pattern.
`ObservableValue`	string	Right-hand side of an equality comparison from the STIX pattern.
`Pattern`	string	Detection pattern for the indicator.
`_ResourceId`	string	Unique identifier for the resource associated with the record.
`Revoked`	bool	Indicates whether the indicator was revoked.
`SourceSystem`	string	Type of agent or source system that collected the event.
`_SubscriptionId`	string	Subscription associated with the record.
`Tags`	string	Sentinel-defined tags for the indicator.
`TenantId`	string	Log Analytics workspace ID.
`TimeGenerated`	datetime	Time of indicator ingestion.
`Type`	string	Name of the table.
`ValidFrom`	datetime	Time from which the indicator is considered valid.
`ValidUntil`	datetime	Time at which the indicator should no longer be considered valid.
`WorkspaceId`	string	Workspace that submitted the indicator.

Sample KQL

Active threat indicators by source

Summarize current indicators imported into Sentinel and identify stale or noisy source systems.

kql

ThreatIntelIndicators
| where TimeGenerated > ago(30d)
| where Active == true
| summarize Indicators=dcount(Id), LastSeen=max(TimeGenerated) by SourceSystem, IndicatorType, ConfidenceScore
| order by Indicators desc