Customers exploring threat intelligence indicators in their cloud workloads today face challenges understanding, aggregating, and actioning data across multiple sources. Threat intelligence is an adv...
Updated Nov 03, 2021
Version 2.0
Blog Post
What is the expected behavior when a third-party feed has duplicate threat indicators to the existing MS indicators? Or if two third-party feeds have duplicates? Is one ignored? If so, which takes priority?
There appears to be a limit on the number of additional indicators that can be added, and we want to understand if those duplicate indicators count against that overall number.
Thanks!