SentinelThreatIntelligenceIndicator

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
DisplayName	Key	String	The display name of the indicator
SubscriptionId	Write	String	The name of the resource group. The name is case insensitive.
ResourceGroupName	Write	String	The name of the resource group. The name is case insensitive.
WorkspaceName	Write	String	The name of the workspace.
Id	Write	String	The unique id of the indicator.
Description	Write	String	The name of the workspace.
PatternType	Write	String	Pattern type of a threat intelligence entity
Pattern	Write	String	Pattern of a threat intelligence entity
Revoked	Write	String	Is threat intelligence entity revoked
ValidFrom	Write	String	Valid from
ValidUntil	Write	String	Valid until
Source	Write	String	Source type.
Labels	Write	String[]	Labels of threat intelligence entity
ThreatIntelligenceTags	Write	String[]	List of tags
ThreatTypes	Write	String[]	Threat types
KillChainPhases	Write	String[]	Kill chain phases
Confidence	Write	UInt32	Confidence of threat intelligence entity
Ensure	Write	String	Present ensures the instance exists, absent ensures it is removed.	Absent, Present
Credential	Write	PSCredential	Credentials of the workload's Admin
ApplicationId	Write	String	Id of the Azure Active Directory application to authenticate with.
TenantId	Write	String	Id of the Azure Active Directory tenant used for authentication.
CertificateThumbprint	Write	String	Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.
CertificatePassword	Write	PSCredential	Username can be made up to anything but password will be used for CertificatePassword
CertificatePath	Write	String	Path to certificate used in service principal usually a PFX file.
ManagedIdentity	Write	Boolean	Managed ID being used for authentication.
AccessTokens	Write	String[]	Access token used for authentication.

Description

Configures threat intelligence indicators in Azure Sentinel.

Permissions

Azure Service Management

To authenticate with the Azure Service Management API, this resource requires the following permissions:

Delegated permissions

• Read

• user_impersonation

• Update

• user_impersonation

Application permissions

• Read

• None

• Update

• None

Azure

To authenticate with the Azure API, this resource requires the following permissions:

Delegated permissions

• Read

• None

• Update

• None

Application permissions

• Read

• None

• Update

• None

Examples

Example 1

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        SentinelThreatIntelligenceIndicator "SentinelThreatIntelligenceIndicator-Example"
        {
            Confidence             = 80;
            Description            = "Command-and-control host observed in a credential phishing campaign against the finance department";
            DisplayName            = "Known phishing domain";
            Ensure                 = "Present";
            KillChainPhases        = @("Command and Control");
            Labels                 = @("Phishing", "Command and Control");
            Pattern                = "[ipv6-addr:value = '2607:fa49:d340:f600:c8d5:6961:247f:a238']";
            PatternType            = "ipv6-addr";
            ResourceGroupName      = "<resource-group-name>";
            Revoked                = "false";
            Source                 = "Microsoft Sentinel";
            SubscriptionId         = "<subscription-id>";
            ThreatIntelligenceTags = @("Finance Phishing Campaign", "Reviewed By SOC");
            ThreatTypes            = @("malicious-activity");
            ValidFrom              = "2026-01-01T00:00:00.0000000Z";
            ValidUntil             = "2026-12-31T00:00:00.0000000Z";
            WorkspaceName          = "<log-analytics-workspace-name>";
            ApplicationId          = $ApplicationId;
            TenantId               = $TenantId;
            CertificateThumbprint  = $CertificateThumbprint;
        }
    }
}

Example 2

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        SentinelThreatIntelligenceIndicator "SentinelThreatIntelligenceIndicator-Example"
        {
            Confidence             = 80;
            Description            = "Command-and-control host observed in a credential phishing campaign against the finance department";
            DisplayName            = "Known phishing domain";
            Ensure                 = "Present";
            KillChainPhases        = @("Command and Control");
            Labels                 = @("Phishing", "Command and Control", "Under Investigation"); # Updated Property
            Pattern                = "[ipv6-addr:value = '2607:fa49:d340:f600:c8d5:6961:247f:a238']";
            PatternType            = "ipv6-addr";
            ResourceGroupName      = "<resource-group-name>";
            Revoked                = "false";
            Source                 = "Microsoft Sentinel";
            SubscriptionId         = "<subscription-id>";
            ThreatIntelligenceTags = @("Finance Phishing Campaign", "Reviewed By SOC");
            ThreatTypes            = @("malicious-activity");
            ValidFrom              = "2026-01-01T00:00:00.0000000Z";
            ValidUntil             = "2026-12-31T00:00:00.0000000Z";
            WorkspaceName          = "<log-analytics-workspace-name>";
            ApplicationId          = $ApplicationId;
            TenantId               = $TenantId;
            CertificateThumbprint  = $CertificateThumbprint;
        }
    }
}

Example 3

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        SentinelThreatIntelligenceIndicator "SentinelThreatIntelligenceIndicator-Example"
        {
            DisplayName           = "Known phishing domain";
            Ensure                = "Absent";
            ApplicationId         = $ApplicationId;
            TenantId              = $TenantId;
            CertificateThumbprint = $CertificateThumbprint;
        }
    }
}