New-MgBetaSecurityTiIndicator

Syntax

CreateExpanded (Default)

New-MgBetaSecurityTiIndicator
    [-ResponseHeadersVariable <string>]
    [-Action <string>]
    [-ActivityGroupNames <string[]>]
    [-AdditionalInformation <string>]
    [-AdditionalProperties <hashtable>]
    [-AzureTenantId <string>]
    [-Confidence <int>]
    [-Description <string>]
    [-DiamondModel <string>]
    [-DomainName <string>]
    [-EmailEncoding <string>]
    [-EmailLanguage <string>]
    [-EmailRecipient <string>]
    [-EmailSenderAddress <string>]
    [-EmailSenderName <string>]
    [-EmailSourceDomain <string>]
    [-EmailSourceIPAddress <string>]
    [-EmailSubject <string>]
    [-EmailXMailer <string>]
    [-ExpirationDateTime <datetime>]
    [-ExternalId <string>]
    [-FileCompileDateTime <datetime>]
    [-FileCreatedDateTime <datetime>]
    [-FileHashType <string>]
    [-FileHashValue <string>]
    [-FileMutexName <string>]
    [-FileName <string>]
    [-FilePacker <string>]
    [-FilePath <string>]
    [-FileSize <long>]
    [-FileType <string>]
    [-Id <string>]
    [-IngestedDateTime <datetime>]
    [-IsActive]
    [-KillChain <string[]>]
    [-KnownFalsePositives <string>]
    [-LastReportedDateTime <datetime>]
    [-MalwareFamilyNames <string[]>]
    [-NetworkCidrBlock <string>]
    [-NetworkDestinationAsn <long>]
    [-NetworkDestinationCidrBlock <string>]
    [-NetworkDestinationIPv4 <string>]
    [-NetworkDestinationIPv6 <string>]
    [-NetworkDestinationPort <int>]
    [-NetworkIPv4 <string>]
    [-NetworkIPv6 <string>]
    [-NetworkPort <int>]
    [-NetworkProtocol <int>]
    [-NetworkSourceAsn <long>]
    [-NetworkSourceCidrBlock <string>]
    [-NetworkSourceIPv4 <string>]
    [-NetworkSourceIPv6 <string>]
    [-NetworkSourcePort <int>]
    [-PassiveOnly]
    [-Severity <int>]
    [-Tags <string[]>]
    [-TargetProduct <string>]
    [-ThreatType <string>]
    [-TlpLevel <string>]
    [-Url <string>]
    [-UserAgent <string>]
    [-Break]
    [-Headers <IDictionary>]
    [-HttpPipelineAppend <SendAsyncStep[]>]
    [-HttpPipelinePrepend <SendAsyncStep[]>]
    [-Proxy <uri>]
    [-ProxyCredential <pscredential>]
    [-ProxyUseDefaultCredentials]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Create

New-MgBetaSecurityTiIndicator
    -BodyParameter <IMicrosoftGraphTiIndicator>
    [-ResponseHeadersVariable <string>]
    [-Break]
    [-Headers <IDictionary>]
    [-HttpPipelineAppend <SendAsyncStep[]>]
    [-HttpPipelinePrepend <SendAsyncStep[]>]
    [-Proxy <uri>]
    [-ProxyCredential <pscredential>]
    [-ProxyUseDefaultCredentials]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Description

Examples

Example 1: Code snippet

Import-Module Microsoft.Graph.Beta.Security

$params = @{
	action = "alert"
	activityGroupNames = @(
	)
	confidence = 0
	description = "This is a canary indicator for demo purpose. Take no action on any observables set in this indicator."
	expirationDateTime = [System.DateTime]::Parse("2019-03-01T21:43:37.5031462+00:00")
	externalId = "Test--8586509942679764298MS501"
	fileHashType = "sha256"
	fileHashValue = "aa64428647b57bf51524d1756b2ed746e5a3f31b67cf7fe5b5d8a9daf07ca313"
	killChain = @(
	)
	malwareFamilyNames = @(
	)
	severity = 0
	tags = @(
	)
	targetProduct = "Azure Sentinel"
	threatType = "WatchList"
	tlpLevel = "green"
}

New-MgBetaSecurityTiIndicator -BodyParameter $params

Parameters

-Action

tiAction

Parameter properties

Parameter sets

-ActivityGroupNames

The cyber threat intelligence name(s) for the parties responsible for the malicious activity covered by the threat indicator.

Parameter properties

Parameter sets

-AdditionalInformation

A catchall area for extra data from the indicator that is not specifically covered by other tiIndicator properties. The security tool specified by targetProduct typically does not utilize this data.

Parameter properties

Parameter sets

-AdditionalProperties

Additional Parameters

Parameter properties

Parameter sets

-AzureTenantId

Stamped by the system when the indicator is ingested. The Microsoft Entra tenant id of submitting client. Required.

Parameter properties

Parameter sets

-BodyParameter

tiIndicator To construct, see NOTES section for BODYPARAMETER properties and create a hash table.

Parameter properties

Parameter sets

-Break

Wait for .NET debugger to attach

Parameter properties

Parameter sets

-Confidence

An integer representing the confidence the data within the indicator accurately identifies malicious behavior. Acceptable values are 0 – 100 with 100 being the highest.

Parameter properties

Parameter sets

-Confirm

Prompts you for confirmation before running the cmdlet.

Parameter properties

Parameter sets

-Description

Brief description (100 characters or less) of the threat represented by the indicator. Required.

Parameter properties

Parameter sets

-DiamondModel

diamondModel

Parameter properties

Parameter sets

-DomainName

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-EmailEncoding

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-EmailLanguage

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-EmailRecipient

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-EmailSenderAddress

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-EmailSenderName

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-EmailSourceDomain

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-EmailSourceIPAddress

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-EmailSubject

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-EmailXMailer

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-ExpirationDateTime

DateTime string indicating when the Indicator expires. All indicators must have an expiration date to avoid stale indicators persisting in the system. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Required.

Parameter properties

Parameter sets

-ExternalId

An identification number that ties the indicator back to the indicator provider’s system (for example, a foreign key).

Parameter properties

Parameter sets

-FileCompileDateTime

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-FileCreatedDateTime

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-FileHashType

fileHashType

Parameter properties

Parameter sets

-FileHashValue

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-FileMutexName

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-FileName

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-FilePacker

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-FilePath

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-FileSize

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-FileType

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-Headers

Optional headers that will be added to the request.

Parameter properties

Parameter sets

-HttpPipelineAppend

SendAsync Pipeline Steps to be appended to the front of the pipeline

Parameter properties

Parameter sets

-HttpPipelinePrepend

SendAsync Pipeline Steps to be prepended to the front of the pipeline

Parameter properties

Parameter sets

-Id

The unique identifier for an entity. Read-only.

Parameter properties

Parameter sets

-IngestedDateTime

Stamped by the system when the indicator is ingested. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z

Parameter properties

Parameter sets

-IsActive

Used to deactivate indicators within system. By default, any indicator submitted is set as active. However, providers may submit existing indicators with this set to ‘False’ to deactivate indicators in the system.

Parameter properties

Parameter sets

-KillChain

A JSON array of strings that describes which point or points on the Kill Chain this indicator targets. See ‘killChain values’ below for exact values.

Parameter properties

Parameter sets

-KnownFalsePositives

Scenarios in which the indicator may cause false positives. This should be human-readable text.

Parameter properties

Parameter sets

-LastReportedDateTime

The last time the indicator was seen. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z

Parameter properties

Parameter sets

-MalwareFamilyNames

The malware family name associated with an indicator if it exists. Microsoft prefers the Microsoft malware family name if at all possible that can be found via the Windows Defender Security Intelligence threat encyclopedia.

Parameter properties

Parameter sets

-NetworkCidrBlock

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkDestinationAsn

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkDestinationCidrBlock

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkDestinationIPv4

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkDestinationIPv6

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkDestinationPort

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkIPv4

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkIPv6

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkPort

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkProtocol

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkSourceAsn

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkSourceCidrBlock

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkSourceIPv4

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkSourceIPv6

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-NetworkSourcePort

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-PassiveOnly

Determines if the indicator should trigger an event that is visible to an end-user. When set to ‘true,’ security tools won't notify the end user that a ‘hit’ has occurred. This is most often treated as audit or silent mode by security products where they'll simply log that a match occurred but won't perform the action. Default value is false.

Parameter properties

Parameter sets

-Proxy

The URI for the proxy server to use

Parameter properties

Parameter sets

-ProxyCredential

Credentials for a proxy server to use for the remote call

Parameter properties

Parameter sets

-ProxyUseDefaultCredentials

Use the default credentials for the proxy

Parameter properties

Parameter sets

-ResponseHeadersVariable

Optional Response Headers Variable.

Parameter properties

Parameter sets

-Severity

An integer representing the severity of the malicious behavior identified by the data within the indicator. Acceptable values are 0 – 5 where 5 is the most severe and zero isn't severe at all. Default value is 3.

Parameter properties

Parameter sets

-Tags

A JSON array of strings that stores arbitrary tags/keywords.

Parameter properties

Parameter sets

-TargetProduct

A string value representing a single security product to which the indicator should be applied. Acceptable values are: Azure Sentinel, Microsoft Defender ATP. Required

Parameter properties

Parameter sets

-ThreatType

Each indicator must have a valid Indicator Threat Type. Possible values are: Botnet, C2, CryptoMining, Darknet, DDoS, MaliciousUrl, Malware, Phishing, Proxy, PUA, WatchList. Required.

Parameter properties

Parameter sets

-TlpLevel

tlpLevel

Parameter properties

Parameter sets

-Url

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-UserAgent

Create a new tiIndicator object.

Permissions

Parameter properties

Parameter sets

-WhatIf

Runs the command in a mode that only reports what would happen without performing the actions.

Parameter properties

Parameter sets

CommonParameters

Inputs

Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphTiIndicator

System.Collections.IDictionary

Outputs

Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphTiIndicator

Notes

Related Links

• New-MgBetaSecurityTiIndicator
• Graph API Reference