MDTI Source TI
Query
//Show TI from the MDTI connector
ThreatIntelligenceIndicator
| where SourceSystem in ("Microsoft Defender Threat Intelligence", "Microsoft Emerging Threat Feed")Explanation
This query is asking to display the Threat Intelligence (TI) from the MDTI connector. It filters the results to only include data from the Microsoft Defender Threat Intelligence and Microsoft Emerging Threat Feed sources.
Details
Rod Trent
Released: March 29, 2023
Tables
ThreatIntelligenceIndicator
Keywords
ThreatIntelligenceIndicatorSourceSystemMicrosoft Defender Threat IntelligenceMicrosoft Emerging Threat Feed
Operators
wherein