intelligenceProfile resource type

Namespace: microsoft.graph.security

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Note

The Microsoft Graph API for Microsoft Defender Threat Intelligence requires an active Defender Threat Intelligence Portal license and API add-on license for the tenant.

The Microsoft Defender Threat Intelligence Profiles (Intel Profile) API provides the most up-to-date threat actor infrastructure visibility in the industry today, enabling threat intelligence and security operations (SecOps) teams to streamline their advanced threat hunting and analysis workflows. These teams have historically struggled to obtain visibility into the full extent of nation state and cybercriminal adversary infrastructures, creating blind spots in detection and response automation, hunting, and analytics. Sophisticated security professionals can use Microsoft Intelligence Profile APIs, along with the indicators and other associated markers, to automate defense of their organizations and track potentially malicious activity targeting their organization or industry. Users of the Microsoft Defender Threat Intelligence Profiles APIs have access to detailed threat actor intel profiles, including background information and interpretation guidance.

Methods

Method Return type Description
List intelligence profiles microsoft.graph.security.intelligenceProfile collection Get a list of the microsoft.graph.security.intelligenceProfile objects and their properties.
Get intelligence profile microsoft.graph.security.intelligenceProfile Read the properties and relationships of a microsoft.graph.security.intelligenceProfile object.
List indicators microsoft.graph.security.intelligenceProfileIndicator collection Get a list of intelligenceProfileIndicator resources.

Properties

Property Type Description
aliases String collection A list of commonly-known aliases for the threat intelligence included in the intelligenceProfile.
countriesOrRegionsOfOrigin microsoft.graph.security.intelligenceProfileCountryOrRegionOfOrigin collection The country/region of origin for the given actor or threat associated with this intelligenceProfile.
description microsoft.graph.security.formattedContent A synopsis of the threat actor. This property places the threat actor in wider context, tracing its discovery, history, significant campaigns, targeting, techniques of note, affiliations with governments, law enforcement countermeasures, and any areas of dispute among the security community regarding attribution.
firstActiveDateTime DateTimeOffset The date and time when this intelligenceProfile was first active. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
id String The system generated ID for this intelligenceProfile.
kind microsoft.graph.security.intelligenceProfileKind A categorization of the type of this intelligenceProfile. The possible values are: actor, tool, unknownFutureValue.
summary microsoft.graph.security.formattedContent A short summary of this intelligenceProfile.
targets String collection Known targets related to this intelligenceProfile.
title String The title of this intelligenceProfile.
tradecraft microsoft.graph.security.formattedContent Formatted information featuring a description of the distinctive tactics, techniques, and procedures (TTP) of the group, followed by a list of all known custom, commodity, and publicly available implants used by the group.

Relationships

Relationship Type Description
indicators microsoft.graph.security.intelligenceProfileIndicator collection Includes an assemblage of high-fidelity network indicators of compromise.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.intelligenceProfile",
  "aliases": [
    "String"
  ],
  "countriesOrRegionsOfOrigin": [
    {
      "@odata.type": "microsoft.graph.security.intelligenceProfileCountryOrRegionOfOrigin"
    }
  ],
  "description": {
    "@odata.type": "microsoft.graph.security.formattedContent"
  },
  "firstActiveDateTime": "String (timestamp)",
  "id": "String (identifier)",
  "kind": "String",
  "summary": {
    "@odata.type": "microsoft.graph.security.formattedContent"
  },
  "targets": [
    "String"
  ],
  "title": "String",
  "tradecraft": {
    "@odata.type": "microsoft.graph.security.formattedContent"
  }
}