← Browse all tablesLoading table information…
Contribute structured examples for this table using the PowerShell tool. Submit a synthetic example.
ThreatIntelIndicators Schema
Table description
| TableSection |
TableType |
TableSectionName |
Description |
Source |
| Usx |
|
Microsoft Sentinel |
Threat Intelligence table that contains STIX indicators. |
Sentinel |
Schema
| Name |
Description |
Type |
| _BilledSize |
|
Double |
| _IsBillable |
|
String |
| _ResourceId |
A unique identifier for the resource that the record is associated with |
String |
| _SubscriptionId |
A unique identifier for the subscription that the record is associated with |
String |
| AdditionalFields |
Additional information about the entity or event |
Object |
| AzureTenantId |
The tenant that submitted the indicator. |
String |
| Confidence |
The confidence that the creator has in the correctness of their data. The value must be a number in the range of 0-100. |
Int32 |
| Created |
The date when the indicator was created. |
DateTime |
| Data |
All object properties, formatted according to the STIX specification (https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.pdf). |
Object |
| Id |
Unique id of the activity log |
String |
| IsActive |
A value that specifies if an indicator is active and valid for detections. |
Boolean |
| IsDeleted |
A value that indicates whether the data was deleted from Sentinel or not. |
Boolean |
| LastUpdateMethod |
The component that last updated the indicator. |
String |
| Modified |
The date when the indicator was modified. |
DateTime |
| ObservableKey |
The entire left-hand side of an equality comparison from the pattern. |
String |
| ObservableValue |
The entire right-hand side of an equality comparison from the pattern. |
String |
| Pattern |
The detection pattern for this indicator MAY be expressed as a STIX pattern. |
String |
| Revoked |
A value that specifies whether the indicator was revoked. |
Boolean |
| SourceSystem |
The name of the source. |
String |
| Tags |
Labels representing various attributes used to identify or categorize a security configuration |
String |
| TenantId |
Unique identifier of the tenant into which the data connector ingests data. |
String |
| TimeGenerated |
The time of indicator ingestion. |
DateTime |
| Type |
The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other |
String |
| ValidFrom |
The time from which this indicator is considered a valid indicator of the behaviors it is related or represents. |
DateTime |
| ValidUntil |
The time at which this indicator should no longer be considered a valid indicator of the bahviors it is related to or represents. |
DateTime |
| WorkspaceId |
The workspace that submitted the indicator. |
String |
Schema changes
| Date |
Action |
| 2026-10-07 |
Table added to tracking |
| 2026-02-27 |
Table removed from tracking |
| 2026-01-02 |
Column Source removed |
| 2024-10-18 |
Table added to tracking |