Integration Service Activities

Last updated Mar 12, 2026

Create New Indicator

Project compatibility

Windows | Cross-platform

Overview

Description	API Method	API Path
Creates a new threat intelligence indicator in Microsoft Sentinel Threat Intelligence using STIX (Structured Threat Information Expression) format. This allows you to upload threat indicators that can be used for security monitoring and threat detection.	POST	/threat-intelligence-stix-objects:upload

Input

Parameter	Description	Data Type
Name	The name or title of the threat indicator. This should be a human-readable description that identifies the threat being represented.	string
Description	A detailed description of the threat indicator. This provides additional context about the threat, its characteristics, and potential impact.	string
Source System	The source system that generated or identified this threat indicator. This identifies the security tool or service (e.g., Defender for Cloud) that detected or created the threat intelligence.	string
Pattern	The STIX pattern that defines the observable characteristics of the threat. This pattern uses STIX Pattern Language syntax to describe the threat indicator, such as file hashes, IP addresses, domains, or other observable properties.	string
Confidence	The confidence level of the threat indicator, expressed as an integer from 0 to 100. Higher values indicate greater confidence in the accuracy of the threat indicator.	string
Valid From	The start date and time from which the threat indicator becomes valid. This marks when the indicator should start being used for threat detection.	date
Valid Until	The expiration date and time for the threat indicator. After this date, the indicator is considered no longer valid or relevant for threat detection purposes.	date
Indicator Types	An array of indicator types that categorize the nature of the threat. Common values include `malicious-activity`, `anomalous-activity`, `attribution`, or other threat classification types.	array
API Version	The API version	string

Note: The API version is set by default to the most recently published and tested API version for the connector. You can change this value to any available version; but full functionality has only been verified for the default version. This parameter is required for the activity to operate correctly.

Output

Parameter	Description	Data Type
Response	The complete response object returned by Create New Indicator.	Object

Note:

In API workflows, a single response object is returned as the output. Any required fields can be extracted directly from this object.
In RPA workflows, some output parameters may differ, but the necessary values can still be retrieved from the response object even if they are not explicitly exposed.

On this page

Project compatibility
Overview
Input
Output

Was this page helpful?

PREVIOUSActivities

NEXTRelease Notes