services / Azure / Microsoft Sentinel threat intelligence bulk actions

TI Bulk Action objects in Microsoft Sentinel represent bulk operations over threat-intelligence (STIX) indicators in the workspace, and the associated indicator/IOC data.

Threat-intelligence indicator data and operations supporting the security-monitoring function.

Microsoft.​SecurityInsights/​threatintelligence/​bulkactions/​Query/​action

Querying Threat Intelligence STIX objects returns the actual indicator content, exporting the organization's tracked IOCs so an attacker can learn detection coverage and avoid flagged infrastructure.

Risks

1. Data exfiltration (CRITICAL)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links