Cortex XDR - IOC
Use the Cortex XDR - IOCs feed integration to sync indicators from Cortex XSOAR to Cortex XDR and back to Cortex XSOAR. Cortex XDR is the world's first detection and response app that natively integrates network, endpoint and cloud data to stop sophisticated attacks.
- Category
- Data Enrichment & Threat Intelligence
- Pack
- CortexXDR
Configuration parameters
- url — Server URL (e.g. https://example.net) (required)
- apikey_id_creds —
- apikey_creds —
- apikey_id — API Key ID
- apikey — API Key
- feed — Fetch indicators
- autoSync — Auto Sync
- severity — Overriding severity value (required)
- feedTags — Tags
- query — Sync Query (required)
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
- feedReputation — Indicator Reputation
- feedReliability — Source Reliability (required)
- tlp_color — Traffic Light Protocol Color
- feedExpirationPolicy —
- feedExpirationInterval —
- feedIncremental — Incremental Feed
- feedFetchInterval — Feed Fetch Interval
- xsoar_severity_field — XSOAR Severity Field
- xsoar_comments_field — XSOAR Comment Field Exporting To XDR
- comments_as_tags — Comments as tags (CSV)
- override_severity — Override severity
- feedBypassExclusionList — Bypass exclusion list
- extensive_logs — Extensive logging (for debugging purposes)
Commands (7)
- xdr-iocs-create-sync-file — Creates the sync file for the manual process. Run this command when instructed by the XDR support team.
- xdr-iocs-disable — Disables IOCs in the XDR server.
- xdr-iocs-enable — Enables IOCs in the XDR server.
- xdr-iocs-push — Push modified IOCs to Cortex XDR.
- xdr-iocs-set-sync-time — Set sync time manually. (Do not use this command unless you understand the consequences.)
- xdr-iocs-sync — Sync your IOC with Cortex XDR.
- xdr-iocs-to-keep-file — Create a file with all the IOCs that are going to sync to Cortex XDR.