Skip to content

Commit 8583446

Browse files
denisebmsftdenisebmsft
authored
Update indicator-manage.md
1 parent fc74cd5 commit 8583446

File tree

1 file changed

+17
-21
lines changed

1 file changed

+17
-21
lines changed

‎defender-endpoint/indicator-manage.md‎

Lines changed: 17 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -15,20 +15,18 @@ ms.collection:
1515
ms.topic: conceptual
1616
ms.subservice: asr
1717
search.appverid: met150
18-
ms.date: 12/18/2020
18+
ms.date: 10/28/2024
1919
---
2020

2121
# Manage indicators
2222

2323
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
2424

25-
2625
**Applies to:**
2726
- [Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
2827
- [Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
2928
- [Microsoft Defender XDR](/defender-xdr)
3029

31-
3230
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink)
3331
3432
1. In the navigation pane, select **Settings** \> **Endpoints** \> **Indicators** (under **Rules**).
@@ -55,32 +53,29 @@ Download the sample CSV to know the supported column attributes.
5553

5654
> [!NOTE]
5755
> Only 500 indicators can be uploaded for each batch.
58-
>
5956
> Attempting to import indicators with specific categories requires the string to be written in Pascal case convention and only accepts the category list available at the portal.
6057
6158
The following table shows the supported parameters.
6259

6360
| Parameter|Type|Description |
6461
| ---| ---| --- |
65-
| indicatorType|Enum|Type of the indicator. Possible values are: *FileSha1*, *FileSha256*, *IpAddress*, *DomainName*, and *Url*. **Required** |
66-
| indicatorValue|String|Identity of the [Indicator](api/ti-indicator.md) entity. **Required** |
67-
| action|Enum|The action that is taken if the indicator is discovered in the organization. Possible values are: *Allowed*, *Audit*, *BlockAndRemediate*, *Warn*, and *Block*. **Required** |
68-
| title|String|Indicator alert title. **Required** |
69-
| description|String| Description of the indicator. **Required** |
70-
| expirationTime|DateTimeOffset|The expiration time of the indicator in the following format YYYY-MM-DDTHH:MM:SS.0Z. The indicator gets deleted if the expiration time passes and whatever happens at the expiration time occurs at the seconds (SS) value. **Optional** |
71-
| severity|Enum|The severity of the indicator. Possible values are: *Informational*, *Low*, *Medium*, and *High*. **Optional** |
72-
| recommendedActions|String|TI indicator alert recommended actions. **Optional** |
73-
| rbacGroups|String|Comma-separated list of RBAC groups the indicator would be applied to. **Optional** |
74-
| category|String|Category of the alert. Examples include: Execution and credential access. **Optional** |
75-
| mitretechniques|String|MITRE techniques code/id (comma separated). For more information, see [Enterprise tactics](https://attack.mitre.org/tactics/enterprise/). **Optional** It's recommended to add a value in category when a MITRE technique. |
76-
| GenerateAlert|String|Whether the alert should be generated. Possible Values are: True or False. **Optional** |
62+
| indicatorType|Enum|Type of the indicator. Possible values are: `FileSha1`, `FileSha256`, `IpAddress`, `DomainName`, and `Url`. <br/> **Required** |
63+
| indicatorValue|String|Identity of the [Indicator](api/ti-indicator.md) entity. <br/> **Required** |
64+
| action|Enum|The action that is taken if the indicator is discovered in the organization. Possible values are: `Allowed`, `Audit`, `BlockAndRemediate`, `Warn`, and `Block`. <br/> **Required** |
65+
| title|String|Indicator alert title.<br/> **Required** |
66+
| description|String| Description of the indicator.<br/> **Required** |
67+
| expirationTime|DateTimeOffset|The expiration time of the indicator in the following format `YYYY-MM-DDTHH:MM:SS.0Z`. The indicator gets deleted if the expiration time passes and whatever happens at the expiration time occurs at the seconds (SS) value. <br/>**Optional** |
68+
| severity|Enum|The severity of the indicator. Possible values are: `Informational`, `Low`, `Medium`, and `High`. <br/>**Optional** |
69+
| recommendedActions|String|TI indicator alert recommended actions. <br/>**Optional** |
70+
| rbacGroups|String|Comma-separated list of RBAC groups the indicator would be applied to. <br/>**Optional** |
71+
| category|String|Category of the alert. Examples include: Execution and credential access. <br/>**Optional** |
72+
| mitretechniques|String|MITRE techniques code/id (comma separated). For more information, see [Enterprise tactics](https://attack.mitre.org/tactics/enterprise/). <br/> **Optional** <br/>It's recommended to add a value in category when a MITRE technique. |
73+
| GenerateAlert|String|Whether the alert should be generated. Possible Values are: `True` or `False`. <br/>**Optional** |
7774

7875
> [!NOTE]
79-
> Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported.
80-
For more information, see [Microsoft Defender for Endpoint alert categories are now aligned with MITRE ATT&CK!](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-atp-alert-categories-are-now-aligned-with/ba-p/732748).
81-
82-
> [!NOTE]
83-
> Network Indicators 'action' type does not support the use of *BlockAndRemediate*. The Network indicator will not import if it is set to *BlockAndRemediate*.
76+
> Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported. For more information, see [Microsoft Defender for Endpoint alert categories are now aligned with MITRE ATT&CK!](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-atp-alert-categories-are-now-aligned-with/ba-p/732748).
77+
>
78+
> Network indicators do not support the action type, `BlockAndRemediate`. If a network indicator is set to `BlockAndRemediate`, it won't import.
8479
8580
Watch this video to learn how Microsoft Defender for Endpoint provides multiple ways to add and manage Indicators of compromise (IoCs).
8681
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qLVw]
@@ -92,4 +87,5 @@ Watch this video to learn how Microsoft Defender for Endpoint provides multiple
9287
- [Create indicators for IPs and URLs/domains](indicator-ip-domain.md)
9388
- [Create indicators based on certificates](indicator-certificates.md)
9489
- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md)
90+
9591
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]

0 commit comments

Comments
 (0)