CTIXDeleteFlaggedIndicators

Deletes indicators ingested from Cyware Intel Exchange (CTIX v3) that are flagged as deprecated, revoked, false positive, reviewed, or whitelisted. All delete flags are disabled by default; the script does nothing until at least one flag is enabled.

Type
python
Pack
CTIX

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

BRAND = "CTIX v3"

# Script argument name -> TIM indicator field (cliName) populated by the CTIX v3 feed.
FLAG_ARG_TO_FIELD = {
    "delete_deprecated": "ctixisdeprecated",
    "delete_revoked": "ctixisrevoked",
    "delete_false_positive": "ctixisfalsepositive",
    "delete_whitelisted": "ctixiswhitelisted",
    "delete_reviewed": "ctixisreviewed",
}


def build_query(args: dict) -> str:
    """Build the deleteIndicators search query from the enabled delete_* flags.

    Returns an empty string when no flag is enabled so callers never issue an
    unscoped delete.
    """
    enabled_fields = [field for arg, field in FLAG_ARG_TO_FIELD.items() if argToBoolean(args.get(arg, False))]
    if not enabled_fields:
        return ""
    flag_conditions = " or ".join(f"{field}:T" for field in enabled_fields)
    return f'sourceBrands:"{BRAND}" and ({flag_conditions})'


def main() -> None:
    try:
        args = demisto.args()
        query = build_query(args)
        if not query:
            return_results("No delete flags enabled; nothing to do.")
            return

        do_not_whitelist = not argToBoolean(args.get("exclude", False))
        reason = args.get("reason") or "Deleted by CTIXDeleteFlaggedIndicators job"

        # execute_command raises DemistoException on an error entry, caught below.
        res = execute_command("deleteIndicators", {"query": query, "doNotWhitelist": do_not_whitelist, "reason": reason})
        return_results(res)

    except Exception as ex:
        return_error(f"Failed to execute CTIXDeleteFlaggedIndicators. Error: {ex}", error=ex)


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README

Deletes indicators ingested from Cyware Intel Exchange (CTIX v3) that are flagged as deprecated, revoked, false positive, reviewed, or whitelisted.

The script builds a Threat Intel query scoped to indicators from the CTIX v3 integration (sourceBrands:"CTIX v3") with any of the enabled flag fields set, and runs the built-in deleteIndicators command on the matches. All delete flags are disabled by default — the script does nothing until at least one flag is explicitly enabled, so it can never issue an unscoped delete.

It is intended to be run on a schedule via the bundled CTIX - Delete Flagged Indicators job (which triggers the playbook of the same name), but can also be run manually from the War Room or Playground.

Note: this script only deletes indicators whose flag fields are already up to date in the Threat Intel Module — run the CTIX feed fetch first so it can update those fields, then run this script (or the bundled job/playbook) to pick up the changes.

Script Data

Name Description
Script Type python3
Cortex XSOAR Version 6.10.0

Inputs

Argument Name Description
delete_deprecated Whether to delete indicators marked as deprecated in Cyware Intel Exchange (CTIX). Default is false.
delete_revoked Whether to delete indicators revoked by their source in Cyware Intel Exchange (CTIX). Default is false.
delete_false_positive Whether to delete indicators marked as false positive in Cyware Intel Exchange (CTIX). Default is false.
delete_whitelisted Whether to delete indicators allow-listed in Cyware Intel Exchange (CTIX). Default is false.
delete_reviewed Whether to delete indicators that have been reviewed in Cyware Intel Exchange (CTIX). Default is false.
exclude Whether to also add the deleted indicators to the Exclusion List. When false (default), indicators are purely deleted and can be re-created if they reappear un-flagged.
reason The reason recorded for the deletion (and exclusion, if enabled).

Command Example

!CTIXDeleteFlaggedIndicators delete_false_positive=true exclude=true reason="Not malicious and used internally"

Human Readable Output

done

Outputs

There are no outputs for this script.