Skip to content

Commit 8212a72

Browse files
update api to acknowledge previous version
1 parent d7296dc commit 8212a72

File tree

1 file changed

+14
-2
lines changed

1 file changed

+14
-2
lines changed

articles/sentinel/upload-indicators-api.md

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,18 @@ The resource/scope value is the audience of the token. This API only accepts the
6262

6363

6464
### Assemble the request message
65+
There were two versions of the legacy API. Depending on the endpoint, a different array name was required in the request body. This was also represented by two versions of the logic app connector action.
66+
67+
:::image type="content" source="media/stix-objects-api/logic-app-sentinel-connector-action-names.png" alt-text="Screenshot of logic app connector action names for Microsoft Sentinel upload indicators API.":::
68+
69+
1. Connector action name: **Threat Intelligence - Upload Indicators of Compromise (Deprecated)**
70+
- Endpoint: `https://sentinelus.azure-api.net/{workspaceId}/threatintelligence:upload-indicators`
71+
- array of indicators name: `value`
72+
73+
1. Connector action name: **Threat Intelligence - Upload Indicators of Compromise (V2) (Preview)**
74+
- Endpoint: `https://sentinelus.azure-api.net/{workspaceId}/threatintelligenceindicators:upload`
75+
- array of indicators name: `indicators`
76+
6577

6678
#### Request URI
6779
API versioning: `api-version=2022-07-01`<br>
@@ -78,7 +90,7 @@ The JSON object for the body contains the following fields:
7890
|Field name |Data Type |Description|
7991
|---|---|---|
8092
|SourceSystem (required)| string | Identify your source system name. The value `Microsoft Sentinel` is restricted.|
81-
|Value (required) | array | An array of indicators in [STIX 2.0 or 2.1 format](https://docs.oasis-open.org/cti/stix/v2.1/cs01/stix-v2.1-cs01.html#_muftrcpnf89v) |
93+
|indicators (required) | array | An array of indicators in [STIX 2.0 or 2.1 format](https://docs.oasis-open.org/cti/stix/v2.1/cs01/stix-v2.1-cs01.html#_muftrcpnf89v) |
8294

8395
Create the array of indicators using the STIX 2.1 indicator format specification, which has been condensed here for your convenience with links to important sections. Also note some properties, while valid for STIX 2.1, don't have corresponding indicator properties in Microsoft Sentinel.
8496

@@ -155,7 +167,7 @@ Approximately 10,000 indicators per minute is the maximum throughput before a th
155167
```json
156168
{
157169
"sourcesystem": "test",
158-
"value":[
170+
"indicators":[
159171
{
160172
"type": "indicator",
161173
"spec_version": "2.1",

0 commit comments

Comments
 (0)