Skip to content

Latest commit

 

History

History
92 lines (68 loc) · 4.67 KB

indicator-manage.md

File metadata and controls

92 lines (68 loc) · 4.67 KB
Raw
title ms.reviewer description ms.service ms.author author ms.localizationpriority manager audience ms.collection ms.topic ms.subservice search.appverid ms.date
Manage indicators
Manage indicators for a file hash, IP address, URLs, or domains that define the detection, prevention, and exclusion of entities.
defender-endpoint
siosulli
siosulli
medium
deniseb
ITPro
m365-security
tier2
mde-asr
conceptual
asr
met150
12/18/2020

Manage indicators

[!INCLUDE Microsoft Defender XDR rebranding]

Applies to:

Want to experience Defender for Endpoint? Sign up for a free trial.

  1. In the navigation pane, select Settings > Endpoints > Indicators (under Rules).

  2. Select the tab of the entity type you'd like to manage.

  3. Update the details of the indicator and select Save or select the Delete button if you'd like to remove the entity from the list.

Import a list of IoCs

You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details.

Download the sample CSV to know the supported column attributes.

  1. In the navigation pane, select Settings > Endpoints > Indicators (under Rules).

  2. Select the tab of the entity type you'd like to import indicators for.

  3. Select Import > Choose file.

  4. Select Import. Repeat for all the files you'd like to import.

  5. Select Done.

Note

Only 500 indicators can be uploaded for each batch.

Attempting to import indicators with specific categories requires the string to be written in Pascal case convention and only accepts the category list available at the portal.

The following table shows the supported parameters.

Parameter Type Description
indicatorType Enum Type of the indicator. Possible values are: FileSha1, FileSha256, IpAddress, DomainName, and Url. Required
indicatorValue String Identity of the Indicator entity. Required
action Enum The action that is taken if the indicator is discovered in the organization. Possible values are: Allowed, Audit, BlockAndRemediate, Warn, and Block. Required
title String Indicator alert title. Required
description String Description of the indicator. Required
expirationTime DateTimeOffset The expiration time of the indicator in the following format YYYY-MM-DDTHH:MM:SS.0Z. The indicator gets deleted if the expiration time passes and whatever happens at the expiration time occurs at the seconds (SS) value. Optional
severity Enum The severity of the indicator. Possible values are: Informational, Low, Medium, and High. Optional
recommendedActions String TI indicator alert recommended actions. Optional
rbacGroups String Comma-separated list of RBAC groups the indicator would be applied to. Optional
category String Category of the alert. Examples include: Execution and credential access. Optional
mitretechniques String MITRE techniques code/id (comma separated). For more information, see Enterprise tactics. Optional It's recommended to add a value in category when a MITRE technique.
GenerateAlert String Whether the alert should be generated. Possible Values are: True or False. Optional

Note

Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported. For more information, see Microsoft Defender for Endpoint alert categories are now aligned with MITRE ATT&CK!.

Watch this video to learn how Microsoft Defender for Endpoint provides multiple ways to add and manage Indicators of compromise (IoCs).

[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qLVw]

See also