Separate expired threat indicators from current action candidates in Defender threat analytics

Source facts

The preview Indicators tab in Defender threat analytics lists indicators associated with a tracked threat. Microsoft researchers update the list as new evidence appears, but it also retains expired indicators to support investigation of past threats. Access to the tab requires tenant verification. Microsoft Learn.

Applicability

Use this distinction when taking indicators from a threat report into an investigation or action review. Presence in that retained list should not be presented as an assertion that every entry has the same current operational status.

DSE recommendation

Preserve an indicator’s historical investigation purpose separately from any proposed current blocking decision. Record the associated report, the indicator’s available status and the period the analyst intends to examine. Keep historical hunting inputs separate from the list awaiting present-day enforcement approval. Do not automatically promote every retained entry into a blocking configuration simply because it appears beside newer intelligence.

Verification

Inspect the selected indicator and its report context before running a bounded historical query. Compare any result with the relevant observation time and document what the match actually establishes. If a current action is proposed, obtain the additional current context and approval needed for that decision instead of recycling the historical match as sufficient justification. Retain nonmatches and access limitations honestly; neither an expired entry nor an empty search is evidence that the environment was never affected. No hunt result or enforcement change is claimed here.

Official references

Microsoft Learn: Threat analytics Indicators preview. Source reviewed September 9, 2026.