`client.indicators`¶

Manage threat indicators.

Property¶

client.indicators

Methods¶

get_all(query: IndicatorsQuery | None = None) -> IndicatorsResults: list indicators with optional filters.
get(id: str) -> IndicatorsResults: fetch one indicator by ID.
submit(payload: IndicatorsSubmitPayload) -> IndicatorsResults: create a single indicator.
batch_import(payload: list[IndicatorsSubmitPayload]) -> ImportIndicatorResults | list[ImportIndicatorResults]: import indicators in batches.
batch_update(payload: BatchUpdateIndicatorPayload) -> Response: batch-update existing indicators.
delete(id: str) -> bool: delete one indicator by ID.
batch_delete(ids: list[str]) -> bool: delete multiple indicators by ID.

Notes¶

batch_import() chunks requests larger than 500 indicators and can return a list of result wrappers.
batch_update() returns the raw httpx.Response from the API.
delete() and batch_delete() return booleans instead of results wrappers.
batch_delete() also chunks oversized requests.

API¶

IndicatorsQuery ¶

Query parameters for the /api/indicators endpoint.

IndicatorsSubmitPayload ¶

Payload for submitting a new indicator.

IndicatorsResults ¶

IndicatorsResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results for the /api/indicators endpoint.

ImportIndicatorResults ¶

ImportIndicatorResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results for the /api/indicators/import endpoint.

IndicatorsEndpoint ¶

IndicatorsEndpoint(http: Client, auth: MSALAuth)

Endpoint for interacting with indicators.

get_all ¶

get_all(
    query: IndicatorsQuery | None = None,
) -> IndicatorsResults

Get indicators with optional filters.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-ti-indicators-collection

get ¶

get(id: str) -> IndicatorsResults

Get a single indicator by ID.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-ti-indicator-by-id

submit ¶

submit(
    payload: IndicatorsSubmitPayload,
) -> IndicatorsResults

Submit a new indicator.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/post-ti-indicator

batch_import ¶

batch_import(
    payload: list[IndicatorsSubmitPayload],
) -> ImportIndicatorResults | list[ImportIndicatorResults]

Batch import indicators.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/import-ti-indicators

batch_update ¶

batch_update(
    payload: BatchUpdateIndicatorPayload,
) -> Response

Batch update indicators.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/batch-update-ti-indicators

delete ¶

delete(id: str) -> bool

Delete an indicator by ID.

If the indicator is successfully deleted, returns True. If the indicator is not found, returns False. If any other error occurs, raises an exception.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/delete-ti-indicator-by-id

batch_delete ¶

batch_delete(ids: list[str]) -> bool

Batch delete indicators by ID.

Note

If Indicators all existed and were deleted successfully - 204 OK without content.
If indicator IDs list is empty or exceeds size limit - 400 Bad Request.
If any indicator ID is invalid - 400 Bad Request.
If any Indicator ID wasn't found - 404 Not Found.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/batch-delete-ti-indicators

client.indicators¶