Cortex XDR IOCs - Disable expired IOCs in XDR

This is a *sub-playbook* of "Cortex XDR IOCs - Push new IOCs to XDR (Main)". This playbook disables indicators in Cortex XDR after they expire from Cortex XSOAR using a loop and querying on the "xdr_pushed" tag.

Pack

CortexXDR

Tasks

9

Inputs

• batch_size
• query

Commands used

• appendIndicatorField
• xdr-iocs-disable