GetIndicatorsByQuery

Gets a list of indicator objects and the associated indicator outputs that match the specified query and filters. The results are returned in a structured data file.

python · Base

Details

ID	`GetIndicatorsByQuery`
Language	python
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	ml

README

Gets a list of indicator objects and the associated indicator outputs that match the specified query and filters. The results are returned in a structured data file.

Script Data

Name	Description
Script Type	python3
Tags	ml
Cortex XSOAR Version	5.5.0

Inputs

Argument Name	Description
query	The indicators query.
dontPopulateFields	A comma-separated list of fields in the object to ignore.
limit	The maximum number of indicators to fetch.
offset	The results offset page. Only change when the number of the results exceed the limit.
addRandomSalt	Salt for the hash function.
fieldsToHash	A comma-separated list of fields to hash. Supports wildcard “*”.
populateFields	A comma-separated list of fields in the object to poplulate. Defaults are id, score, and investigationIDs.

Outputs

There are no outputs for this script.

Source

GetIndicatorsByQuery.py GetIndicatorsByQuery_test.py GetIndicatorsByQuery.yml

Download History Raw

args:
- description: The indicators query.
  name: query
- description: A comma-separated list of fields in the object to ignore.
  name: dontPopulateFields
- defaultValue: '10000'
  description: The maximum number of indicators to fetch.
  name: limit
- defaultValue: '0'
  description: The results offset page. Only change when the number of the results exceed the limit.
  name: offset
- description: Salt for the hash function.
  name: addRandomSalt
  secret: true
- description: A comma-separated list of fields to hash. Supports wildcard "*".
  name: fieldsToHash
- defaultValue: id,value,score,investigationsCount,indicator_type
  description: A comma-separated list of fields in the object to populate. Defaults are id,value,score,investigationsCount (RelatedIncCount),indicator_type. Set to "ALL" to receive all fields.
  name: populateFields
comment: Gets a list of indicator objects and the associated indicator outputs that match the specified query and filters. The results are returned in a structured data file.
commonfields:
  id: GetIndicatorsByQuery
  version: -1
enabled: true
name: GetIndicatorsByQuery
script: '-'
subtype: python3
tags:
- ml
timeout: '0'
type: python
dockerimage: demisto/python3:3.12.13.10116658
runas: DBotWeakRole
fromversion: 5.5.0
tests:
- GetIndicatorsByQuery - Test