ESC
Type to search...
↑↓ Navigate ↵ Open ESC Close

ThreatIntelligence.Read.All

Export JSON
Export CSV
Copy URL
Print
ApplicationDelegated Read All Resources

Allows the app to read threat intelligence information, such as indicators, observations, and and articles, without a signed in user.

Permission data: April 6, 2026 at 4:06 AM UTC
Delegated Access App-Only Access

Permission Details

Application Permission

Read all Threat Intelligence Information

Allows the app to read threat intelligence information, such as indicators, observations, and and articles, without a signed in user.

Permission ID: e0b77adb-e790-44a3-b0a0-257d06303687
Delegated Permission Admin consent required

Read all threat intelligence information

Allows the app to read threat intelligence information, such as indicators, observations, and articles, on behalf of the signed-in user.

User sees: Allows the app to read threat intelligence information, such as indicators, observations, and articles, on your behalf.
Permission ID: f266d9c0-ccb9-4fb8-a228-01ac0d8d6627

Properties

Microsoft Graph v1.0 endpoint-derived-docs

Properties is shown from stable Microsoft Graph v1.0 metadata.

Property Type Description
alerts alert collection
alerts_v2 security.alert collection A collection of alerts in Microsoft 365 Defender.
attackSimulation object
cases object
dataSecurityAndGovernance object
id string The unique identifier for an entity. Read-only.
identities object A container for security identities APIs.
incidents security.incident collection A collection of incidents in Microsoft 365 Defender, each of which is a set of correlated alerts and associated metadata that reflects the story of an attack.
labels object
secureScoreControlProfiles secureScoreControlProfile collection
secureScores secureScore collection
subjectRightsRequests subjectRightsRequest collection
threatIntelligence object
triggers object
triggerTypes object

JSON Representation

Microsoft Graph v1.0 endpoint-derived-docs

JSON representation is shown from stable Microsoft Graph v1.0 metadata.

JSON representation 
{}

Relationships

Microsoft Graph v1.0 endpoint-derived-docs

Relationships is shown from stable Microsoft Graph v1.0 metadata.

Relationship Type Description
alerts alert collection Read-only. Nullable.
alertsv2 security.alert collection A collection of alerts in Microsoft 365 Defender.
data security and compliance tenantDataSecurityAndGovernance A container for Microsoft Purview data security and compliance APIs.
identities security.identityContainer A container for security identities APIs.
incidents security.incident collection A collection of incidents in Microsoft 365 Defender, each of which is a set of correlated alerts and associated metadata that reflects the story of an attack.
articles article collection Threat intelligence articles.
intelProfiles intelligenceProfile collection Threat intelligence profiles.
alerts_v2 security.alert collection A collection of alerts in Microsoft 365 Defender.
secureScoreControlProfiles secureScoreControlProfile collection Related secureScoreControlProfiles data exposed by this resource.
secureScores secureScore collection Related secureScores data exposed by this resource.
subjectRightsRequests subjectRightsRequest collection Related subjectRightsRequests data exposed by this resource.
cloudAppSecurityProfiles cloudAppSecurityProfile collection Related cloudAppSecurityProfiles data exposed by this resource.
domainSecurityProfiles domainSecurityProfile collection Related domainSecurityProfiles data exposed by this resource.
fileSecurityProfiles fileSecurityProfile collection Related fileSecurityProfiles data exposed by this resource.
hostSecurityProfiles hostSecurityProfile collection Related hostSecurityProfiles data exposed by this resource.
incidentTasks security.incidentTask collection A collection of tasks associated with security incidents.
ipSecurityProfiles ipSecurityProfile collection Related ipSecurityProfiles data exposed by this resource.
providerTenantSettings providerTenantSetting collection Related providerTenantSettings data exposed by this resource.
securityActions securityAction collection Related securityActions data exposed by this resource.
tiIndicators tiIndicator collection Related tiIndicators data exposed by this resource.
userSecurityProfiles userSecurityProfile collection Related userSecurityProfiles data exposed by this resource.
zones security.zone collection A collection of cloud zones in Microsoft Defender for Cloud that group and manage cloud environments across multiple cloud providers.

Graph Methods

Delegated access App-only access
Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /security/threatIntelligence/articleIndicators/{articleIndicatorId}
GET /security/threatIntelligence/articles
GET /security/threatIntelligence/articles/{articleId}
GET /security/threatIntelligence/articles/{articleId}/indicators
GET /security/threatIntelligence/hostComponents/{hostComponentId}
GET /security/threatIntelligence/hostCookies/{hostCookieId}
GET /security/threatIntelligence/hostPairs/{hostPairId}
GET /security/threatIntelligence/hostPorts/{hostPortId}
GET /security/threatIntelligence/hosts/{hostId}
GET /security/threatIntelligence/hosts/{hostId}/childHostPairs
GET /security/threatIntelligence/hosts/{hostId}/components
GET /security/threatIntelligence/hosts/{hostId}/cookies
GET /security/threatIntelligence/hosts/{hostId}/hostPairs
GET /security/threatIntelligence/hosts/{hostId}/parentHostPairs
GET /security/threatIntelligence/hosts/{hostId}/passiveDns
GET /security/threatIntelligence/hosts/{hostId}/passiveDnsReverse
GET /security/threatIntelligence/hosts/{hostId}/ports
GET /security/threatIntelligence/hosts/{hostId}/reputation
GET /security/threatIntelligence/hosts/{hostId}/sslCertificates
GET /security/threatIntelligence/hosts/{hostId}/subdomains
GET /security/threatIntelligence/hosts/{hostId}/trackers
GET /security/threatIntelligence/hosts/{hostId}/whois
GET /security/threatIntelligence/hosts/{hostId}/whois/history
GET /security/threatIntelligence/hostSslCertificates/{hostSslCertificateId}
GET /security/threatIntelligence/hostTrackers/{hostTrackerId}
GET /security/threatIntelligence/intelligenceProfileIndicators/{intelligenceProfileIndicatorId}
GET /security/threatIntelligence/intelProfiles
GET /security/threatIntelligence/intelProfiles/{intelligenceProfileId}
GET /security/threatIntelligence/intelProfiles/{intelligenceProfileId}/indicators
GET /security/threatIntelligence/passiveDnsRecords/{passiveDnsRecordId}
GET /security/threatIntelligence/sslCertificates?$search="{propertyname}:{propertyvalue}"
GET /security/threatIntelligence/sslCertificates/{sslCertificateId}
GET /security/threatIntelligence/sslCertificates/{sslCertificateId}/relatedHosts
GET /security/threatIntelligence/subdomains/{subdomainId}
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components/{vulnerabilityComponentId}
GET /security/threatIntelligence/whoisHistoryRecord/{whoisHistoryRecordId}
GET /security/threatIntelligence/whoisRecords?$search="{value}"
GET /security/threatIntelligence/whoisRecords/{id}/history
GET /security/threatIntelligence/whoisRecords/{whoisRecordId}
Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /security/threatIntelligence/articleIndicators/{articleIndicatorId}
GET /security/threatIntelligence/articles
GET /security/threatIntelligence/articles/{articleId}
GET /security/threatIntelligence/articles/{articleId}/indicators
GET /security/threatIntelligence/hostComponents/{hostComponentId}
GET /security/threatIntelligence/hostCookies/{hostCookieId}
GET /security/threatIntelligence/hostPairs/{hostPairId}
GET /security/threatIntelligence/hostPorts/{hostPortId}
GET /security/threatIntelligence/hosts/{hostId}
GET /security/threatIntelligence/hosts/{hostId}/childHostPairs
GET /security/threatIntelligence/hosts/{hostId}/components
GET /security/threatIntelligence/hosts/{hostId}/cookies
GET /security/threatIntelligence/hosts/{hostId}/hostPairs
GET /security/threatIntelligence/hosts/{hostId}/parentHostPairs
GET /security/threatIntelligence/hosts/{hostId}/passiveDns
GET /security/threatIntelligence/hosts/{hostId}/passiveDnsReverse
GET /security/threatIntelligence/hosts/{hostId}/ports
GET /security/threatIntelligence/hosts/{hostId}/reputation
GET /security/threatIntelligence/hosts/{hostId}/sslCertificates
GET /security/threatIntelligence/hosts/{hostId}/subdomains
GET /security/threatIntelligence/hosts/{hostId}/trackers
GET /security/threatIntelligence/hosts/{hostId}/whois
GET /security/threatIntelligence/hosts/{hostId}/whois/history
GET /security/threatIntelligence/hostSslCertificates/{hostSslCertificateId}
GET /security/threatIntelligence/hostTrackers/{hostTrackerId}
GET /security/threatIntelligence/intelligenceProfileIndicators/{intelligenceProfileIndicatorId}
GET /security/threatIntelligence/intelProfiles
GET /security/threatIntelligence/intelProfiles/{intelligenceProfileId}
GET /security/threatIntelligence/intelProfiles/{intelligenceProfileId}/indicators
GET /security/threatIntelligence/passiveDnsRecords/{passiveDnsRecordId}
GET /security/threatIntelligence/sslCertificates
GET /security/threatIntelligence/sslCertificates/{sslCertificateId}
GET /security/threatIntelligence/sslCertificates/{sslCertificateId}/relatedHosts
GET /security/threatIntelligence/subdomains/{subdomainId}
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components/{vulnerabilityComponentId}
GET /security/threatIntelligence/whoisHistoryRecord/{whoisHistoryRecordId}
GET /security/threatIntelligence/whoisRecords?$search="{value}"
GET /security/threatIntelligence/whoisRecords/{id}/history
GET /security/threatIntelligence/whoisRecords/{whoisRecordId}
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
Get-MgSecurityThreatIntelligenceArticle /security/threatIntelligence/articles
List articles
Get-MgSecurityThreatIntelligenceArticle /security/threatIntelligence/articles/{articleId}
Get article
Get-MgSecurityThreatIntelligenceArticleIndicator /security/threatIntelligence/articleIndicators/{articleIndicatorId}
Get articleIndicator
Get-MgSecurityThreatIntelligenceHost /security/threatIntelligence/hosts/{hostId}
Get host
Get-MgSecurityThreatIntelligenceHostChildHostPair /security/threatIntelligence/hosts/{hostId}/childHostPairs
List childHostPairs
Get-MgSecurityThreatIntelligenceHostComponent /security/threatIntelligence/hostComponents/{hostComponentId}
Get hostComponent
Get-MgSecurityThreatIntelligenceHostCookie /security/threatIntelligence/hostCookies/{hostCookieId}
Get hostCookie
Get-MgSecurityThreatIntelligenceHostPair /security/threatIntelligence/hostPairs/{hostPairId}
Get hostPair
Get-MgSecurityThreatIntelligenceHostParentHostPair /security/threatIntelligence/hosts/{hostId}/parentHostPairs
List parentHostPairs
Get-MgSecurityThreatIntelligenceHostPassiveDns /security/threatIntelligence/hosts/{hostId}/passiveDns
List passiveDns
Get-MgSecurityThreatIntelligenceHostPassiveDnsReverse /security/threatIntelligence/hosts/{hostId}/passiveDnsReverse
List passiveDnsReverse
Get-MgSecurityThreatIntelligenceHostPort /security/threatIntelligence/hostPorts/{hostPortId}
Get hostPort
Get-MgSecurityThreatIntelligenceHostReputation /security/threatIntelligence/hosts/{hostId}/reputation
Get hostReputation
Get-MgSecurityThreatIntelligenceHostSslCertificate /security/threatIntelligence/hostSslCertificates/{hostSslCertificateId}
Get hostSslCertificate
Get-MgSecurityThreatIntelligenceHostSubdomain /security/threatIntelligence/hosts/{hostId}/subdomains
List subdomains
Get-MgSecurityThreatIntelligenceHostTracker /security/threatIntelligence/hostTrackers/{hostTrackerId}
Get hostTracker
Get-MgSecurityThreatIntelligenceHostWhoi /security/threatIntelligence/hosts/{hostId}/whois
Get whoisRecord
Get-MgSecurityThreatIntelligenceIntelProfile /security/threatIntelligence/intelProfiles
List intelProfiles
Get-MgSecurityThreatIntelligenceIntelProfile /security/threatIntelligence/intelProfiles/{intelligenceProfileId}
Get intelligenceProfile
Get-MgSecurityThreatIntelligenceIntelProfileIndicator /security/threatIntelligence/intelProfiles/{intelligenceProfileId}/indicators
List indicators
Get-MgSecurityThreatIntelligencePassiveDnsRecord /security/threatIntelligence/passiveDnsRecords/{passiveDnsRecordId}
Get passiveDnsRecord
Get-MgSecurityThreatIntelligenceProfileIndicator /security/threatIntelligence/intelligenceProfileIndicators/{intelligenceProfileIndicatorId}
Get intelligenceProfileIndicator
Get-MgSecurityThreatIntelligenceSslCertificate /security/threatIntelligence/sslCertificates?$search="{propertyname}:{propertyvalue}"
List sslCertificates
Get-MgSecurityThreatIntelligenceSslCertificate /security/threatIntelligence/sslCertificates/{sslCertificateId}
Get sslCertificate
Get-MgSecurityThreatIntelligenceSslCertificateRelatedHost /security/threatIntelligence/sslCertificates/{sslCertificateId}/relatedHosts
List relatedHosts
Get-MgSecurityThreatIntelligenceSubdomain /security/threatIntelligence/subdomains/{subdomainId}
Get subdomain
Get-MgSecurityThreatIntelligenceVulnerability /security/threatIntelligence/vulnerabilities/{vulnerabilityId}
Get vulnerability
Get-MgSecurityThreatIntelligenceVulnerabilityComponent /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components
List components
Get-MgSecurityThreatIntelligenceVulnerabilityComponent /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components/{vulnerabilityComponentId}
Get vulnerabilityComponent
Get-MgSecurityThreatIntelligenceWhoisRecord /security/threatIntelligence/hosts/{hostId}/whois
Get whoisRecord
Get-MgSecurityThreatIntelligenceWhoisRecord /security/threatIntelligence/whoisRecords?$search="{value}"
List whoisRecords
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
Get-MgBetaSecurityThreatIntelligenceArticle /security/threatIntelligence/articles
List articles
Get-MgBetaSecurityThreatIntelligenceArticle /security/threatIntelligence/articles/{articleId}
Get article
Get-MgBetaSecurityThreatIntelligenceArticleIndicator /security/threatIntelligence/articleIndicators/{articleIndicatorId}
Get articleIndicator
Get-MgBetaSecurityThreatIntelligenceHost /security/threatIntelligence/hosts/{hostId}
Get host
Get-MgBetaSecurityThreatIntelligenceHostChildHostPair /security/threatIntelligence/hosts/{hostId}/childHostPairs
List childHostPairs
Get-MgBetaSecurityThreatIntelligenceHostComponent /security/threatIntelligence/hostComponents/{hostComponentId}
Get hostComponent
Get-MgBetaSecurityThreatIntelligenceHostCookie /security/threatIntelligence/hostCookies/{hostCookieId}
Get hostCookie
Get-MgBetaSecurityThreatIntelligenceHostPair /security/threatIntelligence/hostPairs/{hostPairId}
Get hostPair
Get-MgBetaSecurityThreatIntelligenceHostParentHostPair /security/threatIntelligence/hosts/{hostId}/parentHostPairs
List parentHostPairs
Get-MgBetaSecurityThreatIntelligenceHostPassiveDns /security/threatIntelligence/hosts/{hostId}/passiveDns
List passiveDns
Get-MgBetaSecurityThreatIntelligenceHostPassiveDnsReverse /security/threatIntelligence/hosts/{hostId}/passiveDnsReverse
List passiveDnsReverse
Get-MgBetaSecurityThreatIntelligenceHostPort /security/threatIntelligence/hostPorts/{hostPortId}
Get hostPort
Get-MgBetaSecurityThreatIntelligenceHostReputation /security/threatIntelligence/hosts/{hostId}/reputation
Get hostReputation
Get-MgBetaSecurityThreatIntelligenceHostSslCertificate /security/threatIntelligence/hostSslCertificates/{hostSslCertificateId}
Get hostSslCertificate
Get-MgBetaSecurityThreatIntelligenceHostSubdomain /security/threatIntelligence/hosts/{hostId}/subdomains
List subdomains
Get-MgBetaSecurityThreatIntelligenceHostTracker /security/threatIntelligence/hostTrackers/{hostTrackerId}
Get hostTracker
Get-MgBetaSecurityThreatIntelligenceHostWhoi /security/threatIntelligence/hosts/{hostId}/whois
Get whoisRecord
Get-MgBetaSecurityThreatIntelligenceIntelProfile /security/threatIntelligence/intelProfiles
List intelProfiles
Get-MgBetaSecurityThreatIntelligenceIntelProfile /security/threatIntelligence/intelProfiles/{intelligenceProfileId}
Get intelligenceProfile
Get-MgBetaSecurityThreatIntelligenceIntelProfileIndicator /security/threatIntelligence/intelProfiles/{intelligenceProfileId}/indicators
List indicators
Get-MgBetaSecurityThreatIntelligencePassiveDnsRecord /security/threatIntelligence/passiveDnsRecords/{passiveDnsRecordId}
Get passiveDnsRecord
Get-MgBetaSecurityThreatIntelligenceProfileIndicator /security/threatIntelligence/intelligenceProfileIndicators/{intelligenceProfileIndicatorId}
Get intelligenceProfileIndicator
Get-MgBetaSecurityThreatIntelligenceSslCertificate /security/threatIntelligence/sslCertificates
List sslCertificates
Get-MgBetaSecurityThreatIntelligenceSslCertificate /security/threatIntelligence/sslCertificates/{sslCertificateId}
Get sslCertificate
Get-MgBetaSecurityThreatIntelligenceSslCertificateRelatedHost /security/threatIntelligence/sslCertificates/{sslCertificateId}/relatedHosts
List relatedHosts
Get-MgBetaSecurityThreatIntelligenceSubdomain /security/threatIntelligence/subdomains/{subdomainId}
Get subdomain
Get-MgBetaSecurityThreatIntelligenceVulnerability /security/threatIntelligence/vulnerabilities/{vulnerabilityId}
Get vulnerability
Get-MgBetaSecurityThreatIntelligenceVulnerabilityComponent /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components
List components
Get-MgBetaSecurityThreatIntelligenceVulnerabilityComponent /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components/{vulnerabilityComponentId}
Get vulnerabilityComponent
Get-MgBetaSecurityThreatIntelligenceWhoisRecord /security/threatIntelligence/hosts/{hostId}/whois
Get whoisRecord
Get-MgBetaSecurityThreatIntelligenceWhoisRecord /security/threatIntelligence/whoisRecords?$search="{value}"
List whoisRecords

Code Examples

C# / .NET SDK
Get article
View official example on Microsoft Learn
// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.ThreatIntelligence.Articles["{article-id}"].GetAsync();
JavaScript
Get article
View official example on Microsoft Learn
const options = {
	authProvider,
};

const client = Client.init(options);

let article = await client.api('/security/threatIntelligence/articles/a272d5ab')
	.get();
PowerShell
Get article
View official example on Microsoft Learn
Import-Module Microsoft.Graph.Security

Get-MgSecurityThreatIntelligenceArticle -ArticleId $articleId
Python
Get article
View official example on Microsoft Learn
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python

result = await graph_client.security.threat_intelligence.articles.by_article_id('article-id').get()

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for ThreatIntelligence.Read.All

4

Grant Admin Consent

Application permissions always require admin consent.