CTIX - Delete Flagged Indicators

Deletes indicators ingested from Cyware Intel Exchange (CTIX v3) that are flagged as deprecated, revoked, false positive, reviewed, or whitelisted, by running the CTIXDeleteFlaggedIndicators script. All delete flags default to false - enable the ones you want via the playbook inputs. Intended to run on a schedule via the bundled 'CTIX - Delete Flagged Indicators' job.

Pack

CTIX

Tasks

3

Inputs

• delete_deprecated — Whether to delete indicators marked as deprecated in Cyware Intel Exchange (CTIX).
• delete_revoked — Whether to delete indicators revoked by their source in Cyware Intel Exchange (CTIX).
• delete_false_positive — Whether to delete indicators marked as false positive in Cyware Intel Exchange (CTIX).
• delete_whitelisted — Whether to delete indicators allow-listed in Cyware Intel Exchange (CTIX).
• delete_reviewed — Whether to delete indicators that have been reviewed in Cyware Intel Exchange (CTIX).
• exclude — Whether to also add the deleted indicators to the Exclusion List. When false (default), indicators are purely deleted and can be re-created if they reappear un-flagged.
• reason — Reason recorded for the deletion (and exclusion, if enabled).