Forum Discussion
Get list of all tiIndicators using Graph API
Hello Community,
I have a Sentinel system with about 30K of TI indicators, that were ingested from Alien Vault using this playbook: Azure-Sentinel/Playbooks/Get-AlienVault_OTX at master · Azure/Azure-Sentinel (github.com).
Now I would like to get a list of all indicators using Graph API. I tried to do it using Graph Explorer with the following query: GET https://graph.microsoft.com/beta/security/tiIndicators
And I got the following response:
After that, I tried to add a new indicator using Graph API: POST https://graph.microsoft.com/beta/security/tiIndicators and a request body from this example: Create threat intelligence indicator - Microsoft Graph beta | Microsoft Docs
Then I did the first step of getting the list of existing indicators and I did see the indicator that was added manually. I went to Sentinel TI to check whether I see this manually added indicator or not there and I did see it.
So my question is the following: Has anyone tried GraphAPI for TI indicators? What am I missing? Why don't I see all my indicators?
It is in beta now, but It seems weird that the GET request shows nothing.
1 Reply
- Jeff WalzerIron ContributorLate to the party on this one but when I run https://graph.microsoft.com/beta/security/tiIndicators in Graph Explorer or Postman, I get a list of IT indicators for my tenant.
Have you tried to re-run this as of late?