{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-sentinel/json-schema/microsoft-sentinel-threat-intelligence-filtering-criteria-schema.json",
  "title": "ThreatIntelligenceFilteringCriteria",
  "description": "Filtering criteria for querying threat intelligence indicators.",
  "x-generated": "2026-11-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-sentinel-threat-intelligence-api-openapi.yml#/components/schemas/ThreatIntelligenceFilteringCriteria",
  "type": "object",
  "properties": {
    "pageSize": {
      "type": "integer",
      "format": "int32",
      "description": "Page size"
    },
    "minConfidence": {
      "type": "integer",
      "format": "int32",
      "description": "Minimum confidence."
    },
    "maxConfidence": {
      "type": "integer",
      "format": "int32",
      "description": "Maximum confidence."
    },
    "minValidUntil": {
      "type": "string",
      "description": "Start time for ValidUntil filter."
    },
    "maxValidUntil": {
      "type": "string",
      "description": "End time for ValidUntil filter."
    },
    "includeDisabled": {
      "type": "boolean",
      "description": "Parameter to include/exclude disabled indicators."
    },
    "sortBy": {
      "type": "array",
      "description": "Columns to sort by and sorting order",
      "items": {
        "$ref": "#/$defs/ThreatIntelligenceSortingCriteria"
      },
      "x-ms-identifiers": []
    },
    "sources": {
      "type": "array",
      "description": "Sources of threat intelligence indicators",
      "items": {
        "type": "string"
      }
    },
    "patternTypes": {
      "type": "array",
      "description": "Pattern types",
      "items": {
        "type": "string"
      }
    },
    "threatTypes": {
      "type": "array",
      "description": "Threat types of threat intelligence indicators",
      "items": {
        "type": "string"
      }
    },
    "ids": {
      "type": "array",
      "description": "Ids of threat intelligence indicators",
      "items": {
        "type": "string"
      }
    },
    "keywords": {
      "type": "array",
      "description": "Keywords for searching threat intelligence indicators",
      "items": {
        "type": "string"
      }
    },
    "skipToken": {
      "type": "string",
      "description": "Skip token."
    }
  },
  "$defs": {
    "ThreatIntelligenceSortingCriteria": {
      "type": "object",
      "description": "List of available columns for sorting",
      "properties": {
        "itemKey": {
          "type": "string",
          "description": "Column name"
        },
        "sortOrder": {
          "$ref": "#/$defs/ThreatIntelligenceSortingOrder",
          "description": "Sorting order (ascending/descending/unsorted)."
        }
      }
    },
    "ThreatIntelligenceSortingOrder": {
      "type": "string",
      "description": "Sorting order (ascending/descending/unsorted).",
      "enum": [
        "unsorted",
        "ascending",
        "descending"
      ],
      "x-ms-enum": {
        "name": "ThreatIntelligenceSortingOrder",
        "modelAsString": true,
        "values": [
          {
            "name": "unsorted",
            "value": "unsorted",
            "description": "unsorted"
          },
          {
            "name": "ascending",
            "value": "ascending",
            "description": "ascending"
          },
          {
            "name": "descending",
            "value": "descending",
            "description": "descending"
          }
        ]
      }
    }
  }
}