Microsoft Defender for Endpoint
Endpoint protectionPost Ti Indicator
In brief
The API reference now documents `rbacGroupNames` as `String[]` and `generateAlert` as `Boolean`. The 400 Bad Request description was also clarified.
What Defender admins need to know
Administrators integrating with this API should verify request schema validation, particularly for RBAC group names and alert-generation settings.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
|expirationTime|DateTimeOffset|The expiration time of the indicator. Optional|
|severity|Enum|The severity of the indicator. Possible values are: Informational, Low, Medium, and High. Optional|
|recommendedActions|String|TI indicator alert recommended actions. Optional|
|rbacGroupNames|String|String[]|Comma-separated list of RBAC group names the indicator would be applied to. Optional|
|educateUrl|String|Custom notification/support URL. Supported for Block and Warn action types for URL indicators. Optional|
|generateAlert|Enum|Boolean|True if alert generation is required, False if this indicator shouldn't generate an alert.|
Response
- If successful, this method returns 200 - OK response code and the created / updated Indicator entity in the response body.
- If not
successful:successful, this methodreturnreturns 400 - Bad Request. BadrequestRequest usually indicates an incorrect request body.
Example
@@ -68,14 +68,14 @@ In the request body, supply a JSON object with the following parameters: |expirationTime|DateTimeOffset|The expiration time of the indicator. **Optional**| |severity|Enum|The severity of the indicator. Possible values are: `Informational`, `Low`, `Medium`, and `High`. **Optional**| |recommendedActions|String|TI indicator alert recommended actions. **Optional**|-|rbacGroupNames|String|Comma-separated list of RBAC group names the indicator would be applied to. **Optional**|+|rbacGroupNames|String[]|Comma-separated list of RBAC group names the indicator would be applied to. **Optional**| |educateUrl|String|Custom notification/support URL. Supported for Block and Warn action types for URL indicators. **Optional**|-|generateAlert|Enum|**True** if alert generation is required, **False** if this indicator shouldn't generate an alert.|+|generateAlert|Boolean|**True** if alert generation is required, **False** if this indicator shouldn't generate an alert.| ## Response - If successful, this method returns 200 - OK response code and the created / updated [Indicator](ti-indicator.md) entity in the response body.-- If not successful: this method return 400 - Bad Request. Bad request usually indicates incorrect body.+- If not successful, this method returns 400 - Bad Request. Bad Request usually indicates an incorrect request body. ## Example