def check_threat_level_filter(self, indicator):
        """To check the threat level before creating indicator into MS Defender."""
        try:
            threat_level = consts.THREAT_LEVEL.upper()
            __method_name = inspect.currentframe().f_code.co_name
            confidence = indicator.get("properties", {}).get("confidence", "0")
            # all indicators are allowed.
            if threat_level == consts.THREAT_LEVEL_FILTER_BENIGN.upper():
                return True

            # suspicious and confidence is 34 - 100.
            elif (
                confidence
                and threat_level == consts.THREAT_LEVEL_FILTER_SUSPICIOUS.upper()
                and int(confidence) > consts.THREAT_LEVEL_INTERMEDIATE
                and int(confidence) <= consts.THREAT_LEVEL_MALICIOUS
            ):
                return True

            # malicious and confidence is 76 - 100.
            elif (
                confidence
                and threat_level == consts.THREAT_LEVEL_FILTER_MALICIOUS.upper()
                and int(confidence) > consts.THREAT_LEVEL_SUSPICIOUS
                and int(confidence) <= consts.THREAT_LEVEL_MALICIOUS
            ):
                return True
            else:
                applogger.debug(
                    "{}(method={}) : {} : {} indicator does not satisfy threat level requirements.".format(
                        consts.LOGS_STARTS_WITH,
                        __method_name,
                        consts.SENTINEL_TO_DEFENDER,
                        indicator.get("properties", {}).get("displayName", None),
                    )
                )
                return False
        except CofenseException as error:
            applogger.error(
                "{}(method={}) : {} : Error occurred while checking indicator confidence and threat level. "
                "Sentinel indicator name : {}. Error : {}.".format(
                    consts.LOGS_STARTS_WITH,
                    __method_name,
                    consts.SENTINEL_TO_DEFENDER,
                    indicator.get("properties", {}).get("displayName", None),
                    error,
                )
            )
            raise CofenseException()
To check the threat level before creating indicator into MS Defender.
Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/IndicatorCreatorToDefender/sentinel.py