CreateNewIndicatorsOnly

Create indicators to the Threat Intel database only if they are not registered. All submitted indicators will be associated with the parent incident. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.

python · Common Scripts

Details

ID	`CreateNewIndicatorsOnly`
Language	python
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	Utility

README

Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.

Script Data

Name	Description
Script Type	python3
Tags	Utility
Cortex XSOAR Version	6.5.0

Inputs

Argument Name	Description
indicator_values	The indicator values
type	The indicator type of the indicators.
source	The indicator source.
verdict	The indicator reputation.
tags	The tags to add to the new indicators.
verbose	Whether to output additional messages as readable output.

Outputs

Path	Description	Type
CreateNewIndicatorsOnly.ID	The indicator ID.	string
CreateNewIndicatorsOnly.Value	The indicator value.	string
CreateNewIndicatorsOnly.Type	The indicator type.	string
CreateNewIndicatorsOnly.Score	The indicator score.	number
CreateNewIndicatorsOnly.CreationStatus	The status of the indicator requested to add. Value is either new, existing, or unavailable.	string

Notice

When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.

Source

CreateNewIndicatorsOnly.py CreateNewIndicatorsOnly_test.py CreateNewIndicatorsOnly.yml

Download History Raw

commonfields:
  id: CreateNewIndicatorsOnly
  version: -1
name: CreateNewIndicatorsOnly
script: ''
type: python
tags:
- Utility
comment: Create indicators to the Threat Intel database only if they are not registered. All submitted indicators will be associated with the parent incident. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
enabled: true
args:
- name: indicator_values
  description: |
    Comma-separated values are not supported because indicator values may contain commas. To pass multiple indicators, provide an array from context.
  isArray: true
- name: type
  auto: PREDEFINED
  predefined:
  - IP
  - CIDR
  - IPv6
  - IPv6CIDR
  - Domain
  - Email
  - URL
  - File
  - File MD5
  - File SHA256
  - File SHA1
  - Account
  - CVE
  - Host
  - ssdeep
  - Registry Key
  description: The indicator type of the indicators.
- name: source
  description: The indicator source.
- name: verdict
  auto: PREDEFINED
  predefined:
  - Unknown
  - Benign
  - Suspicious
  - Malicious
  description: The indicator reputation.
- name: tags
  description: The tags to add to the new indicators.
  isArray: true
- name: associate_to_current
  auto: PREDEFINED
  predefined:
    - "true"
    - "false"
  defaultValue: "false"
  description: Whether to force the association of the indicator to the current incident.
- name: verbose
  auto: PREDEFINED
  predefined:
  - "true"
  - "false"
  description: Whether to output additional messages as readable output.
outputs:
- contextPath: CreateNewIndicatorsOnly.ID
  description: The indicator ID.
  type: string
- contextPath: CreateNewIndicatorsOnly.Value
  description: The indicator value.
  type: string
- contextPath: CreateNewIndicatorsOnly.Type
  description: The indicator type.
  type: string
- contextPath: CreateNewIndicatorsOnly.Score
  description: The indicator score.
  type: number
- contextPath: CreateNewIndicatorsOnly.CreationStatus
  description: The status of the indicator requested to add. Value is either new, existing, or unavailable.
  type: string
scripttarget: 0
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
runas: DBotWeakRole
fromversion: 6.5.0
tests:
- No tests (auto formatted)