Cortex XDR - IOC

Use the Cortex XDR - IOCs feed integration to sync indicators from Cortex XSOAR to Cortex XDR and back to Cortex XSOAR. Cortex XDR is the world's first detection and response app that natively integrates network, endpoint and cloud data to stop sophisticated attacks.

Data Enrichment & Threat Intelligence · Cortex XDR by Palo Alto Networks · Feed

Configuration parameters

  • url — Server URL (e.g. https://example.net) (required)
  • apikey_id_creds —
  • apikey_creds —
  • apikey_id — API Key ID
  • apikey — API Key
  • feed — Fetch indicators
  • autoSync — Auto Sync
  • severity — Overriding severity value (required)
  • feedTags — Tags
  • query — Sync Query (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedIncremental — Incremental Feed
  • feedFetchInterval — Feed Fetch Interval
  • xsoar_severity_field — XSOAR Severity Field
  • xsoar_comments_field — XSOAR Comment Field Exporting To XDR
  • comments_as_tags — Comments as tags (CSV)
  • override_severity — Override severity
  • feedBypassExclusionList — Bypass exclusion list
  • extensive_logs — Extensive logging (for debugging purposes)

Commands (7)

  • xdr-iocs-create-sync-file

    Creates the sync file for the manual process. Run this command when instructed by the XDR support team.

  • xdr-iocs-disable

    Disables IOCs in the XDR server.

  • xdr-iocs-enable

    Enables IOCs in the XDR server.

  • xdr-iocs-push

    Push modified IOCs to Cortex XDR.

  • xdr-iocs-set-sync-time Deprecated

    Set sync time manually. (Do not use this command unless you understand the consequences.)

  • xdr-iocs-sync

    Sync your IOC with Cortex XDR.

  • xdr-iocs-to-keep-file

    Create a file with all the IOCs that are going to sync to Cortex XDR.