ExportIndicatorsToCSV

This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.

python · Common Scripts

Details

ID	`ExportIndicatorsToCSV`
Language	python
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	Utility

README

This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.

Script Data

Name	Description
Script Type	python3
Tags	Utility

Dependencies

This script uses the following commands and scripts.

core-api-get
core-api-post

Inputs

Argument Name	Description
query	The query for the Indicators that you want to export. (e.g. type:IP and reputation:Bad and expirationStatus:active). You can and should generate the query from the Indicators search screen.
seenDays	Indicator last seen days (default is 7). Needs to be a number.
columns	Comma separated list of columns (fields) for the CSV. (Default is: id,indicator_type,value,source,score,relatedIncCount,setBy,sourceBrands,modified)

Outputs

There are no outputs for this script.

Source

ExportIndicatorsToCSV.py ExportIndicatorsToCSV_test.py ExportIndicatorsToCSV.yml

Download History Raw

args:
- description: The query for the Indicators that you want to export. (e.g. type:IP and reputation:Bad and expirationStatus:active). You can and should generate the query from the Indicators search screen.
  name: query
  required: true
- defaultValue: "7"
  description: Indicator last seen days  (default is 7).  Needs to be a number.
  name: seenDays
- description: 'Comma separated list of columns (fields) for the CSV.  (Default is: id,indicator_type,value,source,score,relatedIncCount,setBy,sourceBrands,modified).'
  name: columns
comment: This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.
commonfields:
  id: ExportIndicatorsToCSV
  version: -1
contentitemexportablefields:
  contentitemfields:
    fromServerVersion: ""
dependson:
  must:
  - core-api-post
  - core-api-get
dockerimage: demisto/python3:3.12.13.10404775
enabled: true
name: ExportIndicatorsToCSV
runas: DBotWeakRole
script: ''
scripttarget: 0
subtype: python3
tags:
- Utility
type: python
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform
supportedModules:
- agentix
- cloud
- cloud_runtime_security
- cloud_posture
- xsiam
- edr
tests:
- No tests (auto formatted)