How to Edit Threat Indicators in Microsoft Sentinel

Rod Trent Microsoft Sentinel January 21, 2022January 21, 2022 1 Minute

Microsoft Sentinel customers have had the capability to organize Threat Indicators through tagging.

But now the ability to modify any Threat indicator is possible. For any indicator provided by Microsoft Sentinel, all fields are editable. For partner indicators, only specific fields are editable such as the tags, Expiration date, Confidence, and Revoked fields.

Select an indicator and right-click to expose the Edit menu option.