Cortex XDR IOCs - Push new IOCs to XDR (Main)

This is the *main* playbook for Cortex XDR IOCs sync. The playbook will "sync" IOCs into Cortex XDR by pushing new IOCs in and disabling expired IOCs. The playbook utilizes Cortex XSOAR tags and loops in order to find IOCs using a query provided by the user. The playbook will iterate over the IOCs pushing them in batches into Cortex XDR. In the second phase, the playbook will disable expired IOCs that were previously pushed into Cortex XDR. We recommend running this playbook as a job a twice a day after disabling the integration sync function.

Pack

CortexXDR

Tasks

7

Inputs

• batch_size — This parameter will set the batch size to be pushed into Cortex XDR with every iteration of the loop.
• query — The query used to search for IOCs from Cortex XSOAR to be pushed into Cortex XDR. This query must include `-tags:xdr_pushed and -tags:xdr_not_processed` in order to work properly.

Commands used

• closeInvestigation