How to query ThreatIntelligenceIndicator tags?

Sean Lim 0 Reputation points
2024-09-09T03:24:54.89+00:00

I have created some indicators on the Threat Intelligence page in Sentinel, and proceeded to tag them as shown below:

Sentinel TI tagging

Based on the Azure Monitor Logs reference for the ThreatIntelligenceIndicator table, there should be a "Tags" field containing free form tags. However, none of these tags show up.

Is this a bug or a feature?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,154 questions

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.