View your threat indicators with KQL

Completed

The indicators reside in the ThreatIntelligenceIndicator table. This table is the basis for queries performed by other Microsoft Sentinel features such as Analytics and Workbooks. Here's how to find and view your threat indicators in the ThreatIntelligenceIndicator table.

To view your threat indicators with KQL. Select Logs from the General section of the Microsoft Sentinel menu. Then run a query on the ThreatIntelligenceIndicator table.

ThreatIntelligenceIndicator