From b8efdfd8dd6499682e34da0fee8170592d580c73 Mon Sep 17 00:00:00 2001 From: jongABCDsudo-rm-rf <157329511+jongABCDsudo-rm-rf@users.noreply.github.com> Date: Fri, 8 May 2026 13:08:10 +1000 Subject: [PATCH 1/2] Document AlertAndBlock action and clarify GenerateAlert mapping --- defender-endpoint/indicator-manage.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/defender-endpoint/indicator-manage.md b/defender-endpoint/indicator-manage.md index c7bd95ad224..e171cebb53b 100644 --- a/defender-endpoint/indicator-manage.md +++ b/defender-endpoint/indicator-manage.md @@ -54,7 +54,7 @@ The following table shows the supported parameters. | ---| ---| --- | | indicatorType|Enum|Type of the indicator. Possible values are: `FileSha1`, `FileSha256`, `IpAddress`, `DomainName`, and `Url`.
**Required** | | indicatorValue|String|Identity of the [Indicator](api/ti-indicator.md) entity.
**Required** | -| action|Enum|The action that is taken if the indicator is discovered in the organization. Possible values are: `Allowed`, `Audit`, `BlockAndRemediate`, `Warn`, and `Block`.
**Required** | +| action|Enum|The action that is taken if the indicator is discovered in the organization. Possible values are: `Allowed`, `Audit`, `BlockAndRemediate`, `Warn`, `Block`, and `AlertAndBlock`.
**Required** | | title|String|Indicator alert title.
**Required** | | description|String| Description of the indicator.
**Required** | | expirationTime|DateTimeOffset|The expiration time of the indicator in the following format `YYYY-MM-DDTHH:MM:SS.0Z`. The indicator gets deleted if the expiration time passes and whatever happens at the expiration time occurs at the seconds (SS) value.
**Optional** | @@ -63,7 +63,7 @@ The following table shows the supported parameters. | rbacGroups|String|Comma-separated list of RBAC groups the indicator would be applied to.
**Optional** | | category|String|Category of the alert. Examples include: Execution and credential access.
**Optional** | | mitretechniques|String|MITRE techniques code/id (comma separated). For more information, see [Enterprise tactics](https://attack.mitre.org/tactics/enterprise/).
**Optional**
It's recommended to add a value in category when a MITRE technique. | -| GenerateAlert|String|Whether the alert should be generated. Possible Values are: `True` or `False`.
**Optional** | +| GenerateAlert|String|Whether the alert should be generated. Possible Values are: `True` or `False`. The API action `AlertAndBlock` is equivalent to setting `action` to `BlockAndRemediate` with `GenerateAlert=True` (rendered in the portal as "Block and remediate" with "Generate alert" ticked).
**Optional** | > [!NOTE] > Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported. For more information, see [Microsoft Defender for Endpoint alert categories are now aligned with MITRE ATT&CK!](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-atp-alert-categories-are-now-aligned-with/ba-p/732748). From e30ac46f41c38d5a44ae9449ff57c6b5366ec9c1 Mon Sep 17 00:00:00 2001 From: Tim Sherer <28902327+TimShererWithAquent@users.noreply.github.com> Date: Wed, 2 Sep 2026 12:46:45 -0700 Subject: [PATCH 2/2] Clarify GenerateAlert field description in documentation Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- defender-endpoint/indicator-manage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defender-endpoint/indicator-manage.md b/defender-endpoint/indicator-manage.md index e171cebb53b..566673a4e7c 100644 --- a/defender-endpoint/indicator-manage.md +++ b/defender-endpoint/indicator-manage.md @@ -63,7 +63,7 @@ The following table shows the supported parameters. | rbacGroups|String|Comma-separated list of RBAC groups the indicator would be applied to.
**Optional** | | category|String|Category of the alert. Examples include: Execution and credential access.
**Optional** | | mitretechniques|String|MITRE techniques code/id (comma separated). For more information, see [Enterprise tactics](https://attack.mitre.org/tactics/enterprise/).
**Optional**
It's recommended to add a value in category when a MITRE technique. | -| GenerateAlert|String|Whether the alert should be generated. Possible Values are: `True` or `False`. The API action `AlertAndBlock` is equivalent to setting `action` to `BlockAndRemediate` with `GenerateAlert=True` (rendered in the portal as "Block and remediate" with "Generate alert" ticked).
**Optional** | +| GenerateAlert|String|Whether the alert should be generated. Possible values are: `True` or `False`. In the Indicators API, `AlertAndBlock` is an alias for setting `action` to `BlockAndRemediate` with `generateAlert` set to `True` (rendered in the portal as **Block and remediate** with **Generate alert** selected).
**Optional** | > [!NOTE] > Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported. For more information, see [Microsoft Defender for Endpoint alert categories are now aligned with MITRE ATT&CK!](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-atp-alert-categories-are-now-aligned-with/ba-p/732748).