[Bug]: TI Lookups using Microsoft Sentinel provider failing due to new table and schema in Sentinel #855
Description
Describe the bug
The TI provider (and built in queries) for Sentinel Threat Intel use the old ThreatIntelligenceIndicator table instead of the new ThreatIntelIndicators. As the old table is no longer being populated with TI data, it will return 0 results even if there is matching TI stored in Sentinel
To Reproduce
Steps to reproduce the behavior:
- Create a piece of TI in Sentinel
- Use IpAddress.tilookup_ip() to try and find it
- Get 0 results
Expected behavior
Matching TI from Sentinel should be returned
Additional context
https://learn.microsoft.com/en-us/azure/sentinel/work-with-threat-indicators?tabs=defender-portal#find-and-view-threat-intelligence-with-queries