RestAPI.json

        "body": {
          "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
          "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
          "type": "Microsoft.SecurityInsights/dataConnectors",
          "kind": "ThreatIntelligence",
          "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
          "properties": {
            "tenantId": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
            "tipLookbackPeriod": "2020-01-01T13:00:30.123Z",
            "dataTypes": {
              "indicators": {
                "state": "Enabled"
              }
            }
          }
        }

ThreatIntelligence.template.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspaceName": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Name for the Azure Sentinel workspace"
      }
    },
    "state": {
      "type": "string",
      "defaultValue": "enabled",
      "allowedValues": [
        "enabled",
        "disabled"
      ],
      "metadata":{
        "description": "Set the state of the connector"
      }
    },
    "tenantId": {
      "type": "string",
      "defaultValue": "[subscription().tenantId]",
      "metadata": {
        "description": "Azure AD tenant ID"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for the resource"
      }
    }
  },
  "variables": {
    "tipName": "[concat('tip', uniqueString(resourceGroup().id))]"
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
      "apiVersion": "2020-01-01",
      "location": "[parameters('location')]",
      "name": "[concat(parameters('workspaceName'),'/Microsoft.SecurityInsights/',variables('tipName'))]",
      "kind": "ThreatIntelligence",
      "properties": {
        "tenantId": "[parameters('tenantId')]",
        "dataTypes": {
          "indicators": {
            "state": "[parameters('state')]"
          }
        }
      }
    }
  ]
}