A lab company, Contoso, connects a community threat intelligence feed to Microsoft Sentinel over TAXII. The connector is green, indicators flow in every hour, the analytics rules start matching. Two weeks later the SOC lead asks a simple question: how many of these indicators are still worth alerting on? The answer turns out to be "all of them, forever, with no idea how sure anyone is".

Rebuilt in my lab tenant with made-up data, checked against Microsoft Learn (October 2026). All names (Contoso, law-lab-sentinel , LabCommunityFeed ) and numbers are lab examples. The diagrams are drawings, not screenshots.

TL;DR

Sentinel stores what the STIX feed sends. If the feed leaves out valid_until and the numeric confidence , your indicators have no expiry and no confidence.…