{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-sentinel/json-schema/microsoft-sentinel-threat-intelligence-indicator-model-schema.json",
  "title": "ThreatIntelligenceIndicatorModel",
  "description": "Threat intelligence indicator entity.",
  "x-generated": "2026-11-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-sentinel-threat-intelligence-api-openapi.yml#/components/schemas/ThreatIntelligenceIndicatorModel",
  "type": "object",
  "properties": {
    "properties": {
      "$ref": "#/$defs/ThreatIntelligenceIndicatorProperties",
      "description": "Threat Intelligence Entity properties",
      "x-ms-client-flatten": true
    }
  },
  "allOf": [
    {
      "$ref": "#/$defs/ThreatIntelligenceInformation"
    }
  ],
  "x-ms-discriminator-value": "indicator",
  "$defs": {
    "EntityCommonProperties": {
      "type": "object",
      "description": "Entity common property bag.",
      "properties": {
        "additionalData": {
          "type": "object",
          "description": "A bag of custom fields that should be part of the entity and will be presented to the user.",
          "additionalProperties": {},
          "readOnly": true
        },
        "friendlyName": {
          "type": "string",
          "description": "The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.",
          "readOnly": true
        }
      }
    },
    "ProxyResource": {
      "type": "object",
      "title": "Proxy Resource",
      "description": "The resource model definition for a Azure Resource Manager proxy resource. It will not have tags and a location",
      "allOf": [
        {
          "$ref": "#/$defs/Resource"
        }
      ]
    },
    "Resource": {
      "type": "object",
      "title": "Resource",
      "description": "Common fields that are returned in the response for all Azure Resource Manager resources",
      "properties": {
        "id": {
          "type": "string",
          "format": "arm-id",
          "description": "Fully qualified resource ID for the resource. E.g. \"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}\"",
          "readOnly": true
        },
        "name": {
          "type": "string",
          "description": "The name of the resource",
          "readOnly": true
        },
        "type": {
          "type": "string",
          "description": "The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or \"Microsoft.Storage/storageAccounts\"",
          "readOnly": true
        },
        "systemData": {
          "$ref": "#/$defs/systemData",
          "description": "Azure Resource Manager metadata containing createdBy and modifiedBy information.",
          "readOnly": true
        }
      },
      "x-ms-azure-resource": true
    },
    "ThreatIntelligenceExternalReference": {
      "type": "object",
      "description": "Describes external reference",
      "properties": {
        "description": {
          "type": "string",
          "description": "External reference description"
        },
        "externalId": {
          "type": "string",
          "description": "External reference ID"
        },
        "sourceName": {
          "type": "string",
          "description": "External reference source name"
        },
        "url": {
          "type": "string",
          "description": "External reference URL"
        },
        "hashes": {
          "type": "object",
          "description": "External reference hashes",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    },
    "ThreatIntelligenceGranularMarkingModel": {
      "type": "object",
      "description": "Describes threat granular marking model entity",
      "properties": {
        "language": {
          "type": "string",
          "description": "Language granular marking model"
        },
        "markingRef": {
          "type": "integer",
          "format": "int32",
          "description": "marking reference granular marking model"
        },
        "selectors": {
          "type": "array",
          "description": "granular marking model selectors",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "ThreatIntelligenceIndicatorProperties": {
      "type": "object",
      "description": "Describes threat intelligence entity properties",
      "properties": {
        "threatIntelligenceTags": {
          "type": "array",
          "description": "List of tags",
          "items": {
            "type": "string"
          }
        },
        "lastUpdatedTimeUtc": {
          "type": "string",
          "description": "Last updated time in UTC"
        },
        "source": {
          "type": "string",
          "description": "Source of a threat intelligence entity"
        },
        "displayName": {
          "type": "string",
          "description": "Display name of a threat intelligence entity"
        },
        "description": {
          "type": "string",
          "description": "Description of a threat intelligence entity"
        },
        "indicatorTypes": {
          "type": "array",
          "description": "Indicator types of threat intelligence entities",
          "items": {
            "type": "string"
          }
        },
        "pattern": {
          "type": "string",
          "description": "Pattern of a threat intelligence entity"
        },
        "patternType": {
          "type": "string",
          "description": "Pattern type of a threat intelligence entity"
        },
        "patternVersion": {
          "type": "string",
          "description": "Pattern version of a threat intelligence entity"
        },
        "killChainPhases": {
          "type": "array",
          "description": "Kill chain phases",
          "items": {
            "$ref": "#/$defs/ThreatIntelligenceKillChainPhase"
          },
          "x-ms-identifiers": []
        },
        "parsedPattern": {
          "type": "array",
          "description": "Parsed patterns",
          "items": {
            "$ref": "#/$defs/ThreatIntelligenceParsedPattern"
          },
          "x-ms-identifiers": []
        },
        "externalId": {
          "type": "string",
          "description": "External ID of threat intelligence entity"
        },
        "createdByRef": {
          "type": "string",
          "description": "Created by reference of threat intelligence entity"
        },
        "defanged": {
          "type": "boolean",
          "description": "Is threat intelligence entity defanged"
        },
        "externalLastUpdatedTimeUtc": {
          "type": "string",
          "description": "External last updated time in UTC"
        },
        "externalReferences": {
          "type": "array",
          "description": "External References",
          "items": {
            "$ref": "#/$defs/ThreatIntelligenceExternalReference"
          },
          "x-ms-identifiers": []
        },
        "granularMarkings": {
          "type": "array",
          "description": "Granular Markings",
          "items": {
            "$ref": "#/$defs/ThreatIntelligenceGranularMarkingModel"
          },
          "x-ms-identifiers": []
        },
        "labels": {
          "type": "array",
          "description": "Labels  of threat intelligence entity",
          "items": {
            "type": "string"
          }
        },
        "revoked": {
          "type": "boolean",
          "description": "Is threat intelligence entity revoked"
        },
        "confidence": {
          "type": "integer",
          "format": "int32",
          "description": "Confidence of threat intelligence entity"
        },
        "objectMarkingRefs": {
          "type": "array",
          "description": "Threat intelligence entity object marking references",
          "items": {
            "type": "string"
          }
        },
        "language": {
          "type": "string",
          "description": "Language of threat intelligence entity"
        },
        "threatTypes": {
          "type": "array",
          "description": "Threat types",
          "items": {
            "type": "string"
          }
        },
        "validFrom": {
          "type": "string",
          "description": "Valid from"
        },
        "validUntil": {
          "type": "string",
          "description": "Valid until"
        },
        "created": {
          "type": "string",
          "description": "Created by"
        },
        "modified": {
          "type": "string",
          "description": "Modified by"
        },
        "extensions": {
          "type": "object",
          "description": "Extensions map",
          "additionalProperties": {}
        }
      },
      "allOf": [
        {
          "$ref": "#/$defs/EntityCommonProperties"
        }
      ]
    },
    "ThreatIntelligenceInformation": {
      "type": "object",
      "description": "Threat intelligence information object.",
      "properties": {
        "kind": {
          "$ref": "#/$defs/ThreatIntelligenceResourceInnerKind",
          "description": "Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type.  If supported, the resource provider must validate and persist this value."
        },
        "etag": {
          "type": "string",
          "description": "Etag of the azure resource"
        }
      },
      "required": [
        "kind"
      ],
      "allOf": [
        {
          "$ref": "#/$defs/ProxyResource"
        }
      ]
    },
    "ThreatIntelligenceKillChainPhase": {
      "type": "object",
      "description": "Describes threat kill chain phase entity",
      "properties": {
        "killChainName": {
          "type": "string",
          "description": "Kill chainName name"
        },
        "phaseName": {
          "type": "string",
          "description": "Phase name"
        }
      }
    },
    "ThreatIntelligenceParsedPattern": {
      "type": "object",
      "description": "Describes parsed pattern entity",
      "properties": {
        "patternTypeKey": {
          "type": "string",
          "description": "Pattern type key"
        },
        "patternTypeValues": {
          "type": "array",
          "description": "Pattern type keys",
          "items": {
            "$ref": "#/$defs/ThreatIntelligenceParsedPatternTypeValue"
          },
          "x-ms-identifiers": []
        }
      }
    },
    "ThreatIntelligenceParsedPatternTypeValue": {
      "type": "object",
      "description": "Describes threat kill chain phase entity",
      "properties": {
        "valueType": {
          "type": "string",
          "description": "Type of the value"
        },
        "value": {
          "type": "string",
          "description": "Value of parsed pattern"
        }
      }
    },
    "ThreatIntelligenceResourceInnerKind": {
      "type": "string",
      "description": "The kind of the threat intelligence entity",
      "enum": [
        "indicator"
      ],
      "x-ms-enum": {
        "name": "ThreatIntelligenceResourceInnerKind",
        "modelAsString": true,
        "values": [
          {
            "name": "indicator",
            "value": "indicator",
            "description": "Entity represents threat intelligence indicator in the system."
          }
        ]
      }
    }
  }
}