Cortex XDR IOCs - Disable expired IOCs in XDR

This is a *sub-playbook* of "Cortex XDR IOCs - Push new IOCs to XDR (Main)". This playbook disables indicators in Cortex XDR after they expire from Cortex XSOAR using a loop and querying on the "xdr_pushed" tag.

Cortex XDR by Palo Alto Networks · 9 tasks · 2 inputs · 0 outputs

Inputs

  • batch_size —
  • query —

Commands used

appendIndicatorField xdr-iocs-disable

Flowchart

yes Start Start Set Done to True - Set Set Done to True Set Add xdr_disabled tag - appendIndicatorField Add xdr_disabled tag appendIndicatorField Get Indicators - SearchIndicator Get Indicators SearchIndicator Check results Check results DeleteContext - DeleteContext DeleteContext DeleteContext Iteration finished Iteration finished Done Done Disable IOCs using xdr-iocs-disable - xdr-iocs-disable Disable IOCs using xdr-io... xdr-iocs-disable