SearchIndicator
Searches Cortex XSOAR Indicators. Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict. You can add additional fields from the indicators using the add_field_to_context argument.
javascript · Common Scripts
Details
| ID | SearchIndicator |
|---|---|
| Language | javascript |
| From Version | 6.5.0 |
| Tags | Utility |
README
Searches Cortex XSOAR Indicators.
Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict.
You can add additional fields from the indicators using the add_field_to_context argument.
Script Data
| Name | Description |
|---|---|
| Script Type | javascript |
| Tags | Utility |
Inputs
| Argument Name | Description |
|---|---|
| query | Query to use to find the Indicators, same as you’d use on the Threat Intel page. |
| size | The number of indicators to return, defaults to a max of 25. |
| add_fields_to_context | A comma seperated list of fields to return to the context, (default: id,indicator_type,value,score,verdict)) |
Outputs
| Path | Description | Type |
|---|---|---|
| foundIndicators.id | The id of the indicator in the XSOAR database. | Unknown |
| foundIndicators.indicator_type | The type of Indicator (i.e. IP, Domain, URL, etc) | Unknown |
| foundIndicators.value | The value of the Indicator | Unknown |
| foundIndicators.score | The numeric score of the indicator (0 = Unknown, 1 = Good, 2 = Suspicious, 3 = Malicious) | Unknown |
| foundIndicators.verdict | The human readable score/verdict of the Indicator. | Unknown |
args: - description: 'Query to use to find the Indicators, same as you''d use on the Threat Intel page. ' name: query required: true - defaultValue: "25" description: The number of indicators to return, defaults to a max of 25. name: size - description: 'A comma separated list of fields to return to the context (default: id,indicator_type,value,score,verdict)).' name: add_fields_to_context comment: |- Searches Cortex XSOAR Indicators. Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict. You can add additional fields from the indicators using the add_field_to_context argument. commonfields: id: SearchIndicator version: -1 contentitemexportablefields: contentitemfields: fromServerVersion: "" enabled: true name: SearchIndicator outputs: - contextPath: foundIndicators.id description: The id of the indicator in the XSOAR database. - contextPath: foundIndicators.indicator_type description: The type of indicator (for example IP, Domain, URL). - contextPath: foundIndicators.value description: The value of the indicator. - contextPath: foundIndicators.score description: The numeric score of the indicator (0 = Unknown, 0.5 = Informational, 1 = Good, 2 = Suspicious, 3 = Bad, 4 = Critical). - contextPath: foundIndicators.verdict description: The human readable score/verdict of the Indicator. runas: DBotWeakRole script: '' scripttarget: 0 tags: - Utility type: javascript fromversion: 6.5.0 tests: - No tests (auto formatted)