{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-sentinel/json-schema/microsoft-sentinel-threat-intelligence-information-schema.json",
  "title": "ThreatIntelligenceInformation",
  "description": "Threat intelligence information object.",
  "x-generated": "2026-11-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-sentinel-threat-intelligence-api-openapi.yml#/components/schemas/ThreatIntelligenceInformation",
  "type": "object",
  "properties": {
    "kind": {
      "$ref": "#/$defs/ThreatIntelligenceResourceInnerKind",
      "description": "Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type.  If supported, the resource provider must validate and persist this value."
    },
    "etag": {
      "type": "string",
      "description": "Etag of the azure resource"
    }
  },
  "required": [
    "kind"
  ],
  "allOf": [
    {
      "$ref": "#/$defs/ProxyResource"
    }
  ],
  "$defs": {
    "ProxyResource": {
      "type": "object",
      "title": "Proxy Resource",
      "description": "The resource model definition for a Azure Resource Manager proxy resource. It will not have tags and a location",
      "allOf": [
        {
          "$ref": "#/$defs/Resource"
        }
      ]
    },
    "Resource": {
      "type": "object",
      "title": "Resource",
      "description": "Common fields that are returned in the response for all Azure Resource Manager resources",
      "properties": {
        "id": {
          "type": "string",
          "format": "arm-id",
          "description": "Fully qualified resource ID for the resource. E.g. \"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}\"",
          "readOnly": true
        },
        "name": {
          "type": "string",
          "description": "The name of the resource",
          "readOnly": true
        },
        "type": {
          "type": "string",
          "description": "The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or \"Microsoft.Storage/storageAccounts\"",
          "readOnly": true
        },
        "systemData": {
          "$ref": "#/$defs/systemData",
          "description": "Azure Resource Manager metadata containing createdBy and modifiedBy information.",
          "readOnly": true
        }
      },
      "x-ms-azure-resource": true
    },
    "ThreatIntelligenceResourceInnerKind": {
      "type": "string",
      "description": "The kind of the threat intelligence entity",
      "enum": [
        "indicator"
      ],
      "x-ms-enum": {
        "name": "ThreatIntelligenceResourceInnerKind",
        "modelAsString": true,
        "values": [
          {
            "name": "indicator",
            "value": "indicator",
            "description": "Entity represents threat intelligence indicator in the system."
          }
        ]
      }
    }
  }
}