Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Add threat intelligence in bulk to Microsoft Sentinel from a CSV or JSON file

4 September 2026Doc update+11 / −7 lines

In brief

The article now distinguishes CSV and JSON template guidance, adds instructions for choosing CSV template options, and describes CSV schema and JSON STIX 2.1 examples more precisely. Documentation metadata was also updated.

What Defender admins need to know

Administrators preparing bulk indicator imports can use the clearer template and formatting guidance to structure their files correctly.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Add threat intelligence in bulk to Microsoft Sentinel from a CSV or JSON file

This article demonstrates how to add indicators from a CSV or STIX objects from a JSON file into Microsoft Sentinel threat intelligence. Because threat intelligence sharing still happens across emails and other informal channels during an ongoing investigation, the ability to import that information quickly into Microsoft Sentinel is important to relay emerging threats to your team. These identified threatsThe imported threat intelligence objects are then available to power other analytics, such as producing security alerts, incidents, and automated responses.

  1. Consider grouping your threat intelligence by source because each file upload requires a source.

The CSV and JSON templates provide all the fields you need to create a single valid indicator, including required fields and validation parameters. Replicate thatthe template field structure to populate more indicators in one file, or add STIX objects to the JSON file. For more information on the templates, see Understand the import templates.

Upload the threat intelligence file

Understand the import templates

Review each templatethe CSV and JSON templates to ensure that your threat intelligence is imported successfully. Be sure to reference the instructions in the CSV or JSON template file and the supplemental guidance in the CSV template structure and JSON template structure sections.

CSV template structure

Use the CSV template options to choose the correct structure for your indicator data.

  1. On the Indicator type dropdown menu, select CSV. Then choose between the File indicators or All other indicator types options.

    The CSV template needs multiple columns to accommodate the file indicator type because file indicators can have multiple hash types like MD5 and SHA256. All other indicator types like IP addresses only require the observable type and the observable value.

    The maximum file size for a CSV file import is 50 MB.

Here's anThe following CSV example shows how to format a domain-name indicator that usesfor bulk import using the CSV template:template schema:

threatTypes,tags,name,description,confidence,revoked,validFrom,validUntil,tlpLevel,severity,observableType,observableValue

### JSON template structure

The JSON template uses a single STIX 2.1 structure for all supported object types. Review the following details when you prepare your JSON file.

1. There's only one JSON template for all STIX object types. The JSON template is based on the STIX 2.1 format.

1. The `type` element supports `indicator`, `attack-pattern`, `identity`, `threat-actor`, and `relationship`.

   The maximum file size for a JSON file import is 250 MB.

Here'sThe following JSON example shows how to define an example `ipv4-addr` indicator and an `attack-pattern` object for bulk import using the JSON fileSTIX 2.1 format:

```json
[