Forum Discussion

mikhailf's avatar
mikhailf
Iron Contributor
Jun 09, 2022

Get list of all tiIndicators using Graph API

Hello Community, 

 

I have a Sentinel system with about 30K of TI indicators, that were ingested from Alien Vault using this playbook: Azure-Sentinel/Playbooks/Get-AlienVault_OTX at master · Azure/Azure-Sentinel (github.com).

 

Now I would like to get a list of all indicators using Graph API. I tried to do it using Graph Explorer with the following query: GET https://graph.microsoft.com/beta/security/tiIndicators

And I got the following response:

 

After that, I tried to add a new indicator using Graph API: POST https://graph.microsoft.com/beta/security/tiIndicators and a request body from this example: Create threat intelligence indicator - Microsoft Graph beta | Microsoft Docs

 

Then I did the first step of getting the list of existing indicators and I did see the indicator that was added manually. I went to Sentinel TI to check whether I see this manually added indicator or not there and I did see it.

 

So my question is the following: Has anyone tried GraphAPI for TI indicators? What am I missing? Why don't I see all my indicators? 

 

It is in beta now, but It seems weird that the GET request shows nothing.

 

 

 

 

1 Reply

  • Jeff Walzer's avatar
    Jeff Walzer
    Iron Contributor
    Late to the party on this one but when I run https://graph.microsoft.com/beta/security/tiIndicators in Graph Explorer or Postman, I get a list of IT indicators for my tenant.

    Have you tried to re-run this as of late?

Resources