Unable to update threat intelligence indicator beta endpoint

Question

I have created and pushed indicator to Microsoft Azure Sentinel. I have checked that I can access it using GET request with

https://graph.microsoft.com/beta/security/tiIndicators/{id}

However when I am trying to update the indicator using PATCH request and the same link, then I am getting this error:

"code": "NotFound",
"message": "The requested resource was not found."

I also tried to update this one indicator by posting id and new attribute to : https://graph.microsoft.com/beta/security/tiIndicators/updateTiIndicators

but then I am getting this error:

"code": "",
"message": "Object reference not set to an instance of an object."

Can not figure out why I am getting such error and how can I update the indicator.

Answer 1

PATCH threat intelligence indicators requires 'targetProduct' and 'expirationDateTime'. Please make sure to specify targetProduct (in this case 'Azure Sentinel' and expirationDateTime in your json that you're trying to update.