category: Data Enrichment & Threat Intelligence
provider: Open Source
commonfields:
  id: ExportIndicators
  version: -1
configuration:
- display: Indicator Query
  name: indicators_query
  type: 0
  required: false
- defaultvalue: text
  display: Outbound Format
  name: format
  options:
  - text
  - json
  - json-seq
  - csv
  - XSOAR json
  - XSOAR json-seq
  - XSOAR csv
  - McAfee Web Gateway
  - Symantec ProxySG
  - PAN-OS URL
  type: 15
  required: false
- additionalinfo: Only applies to IPs in text or csv formats.
  defaultvalue: Don't Collapse
  display: Should Collapse IPs
  name: collapse_ips
  options:
  - Don't Collapse
  - To CIDRs
  - To Ranges
  type: 15
  required: false
- additionalinfo: If selected, csv and XSOAR-csv formats will create a textual web page instead of downloading a CSV file.
  display: Show CSV Formats as Text
  name: csv_text
  type: 8
  required: false
- defaultvalue: '10000'
  display: List Size
  name: list_size
  required: true
  type: 0
- display: Update On-Demand Only
  name: on_demand
  type: 8
  required: false
- defaultvalue: 5 minutes
  additionalinfo: How often to refresh the exported indicators (e.g., 5 minutes, 12 hours, 7 days, 3 months, 1 year). For performance reasons, we do not recommend setting this value to less than 1 minute.
  display: Refresh Rate
  name: cache_refresh_rate
  type: 0
  required: false
- defaultvalue: 'true'
  display: Long Running Instance
  hidden: true
  name: longRunning
  type: 8
  required: false
- additionalinfo: Requires a unique port for each long-running integration instance. Do not use the same port for multiple instances.
  display: Listen Port
  name: longRunningPort
  required: true
  type: 0
- display: Certificate (Required for HTTPS)
  name: certificate
  type: 12
  required: false
- display: Append String To EDL
  name: append_string
  type: 12
  additionalinfo: String to add to end of published EDL, if type is Text. Supports Newline characters (\n).
  required: false
- display: Prepend String To EDL
  name: prepend_string
  type: 12
  additionalinfo: String to add to beginning of published EDL, if type is Text. Supports Newline characters (\n).
  required: false
- display: Private Key (Required for HTTPS)
  name: key
  type: 14
  required: false
- additionalinfo: Enable basic authentication for accessing the EDL. If empty, no authentication is enforced.
  display: Username
  name: credentials
  type: 9
  required: false
- additionalinfo: For use with McAfee Web Gateway format to indicate the list type.
  defaultvalue: string
  display: Mcafee Gateway Indicator List Type
  name: mwg_type
  options:
  - string
  - applcontrol
  - dimension
  - category
  - ip
  - mediatype
  - number
  - regex
  type: 15
  required: false
- additionalinfo: When set to true and certificate & private key are provided will add the HSTS header to all requests.
  display: Add HSTS header
  name: hsts_header
  type: 8
  required: false
  defaultvalue: 'false'
- additionalinfo: For use with PAN-OS URL format - if selected will strip the port from URLs. If not selected - URLs with ports will be ignored.
  display: PAN-OS URL Format Port Strip
  name: strip_port
  type: 8
  required: false
- additionalinfo: For use with PAN-OS URL format - if selected, any URL entry that is not compliant with PAN-OS EDL URL format is dropped instead of being rewritten.
  display: PAN-OS URL Format Drop Invalid Entries
  name: drop_invalids
  type: 8
  required: false
- additionalinfo: For use with Symantec ProxySG format - set the default category for the output.
  display: Symantec ProxySG Default Category
  name: category_default
  type: 0
  required: false
  defaultvalue: bc_category
- additionalinfo: "For use with Symantec ProxySG format - set the categories that should be listed in the output. If not set, will list all existing categories."
  display: Symantec ProxySG Listed Categories
  name: category_attribute
  type: 0
  required: false
- additionalinfo: "NGINX global directives to be passed on the command line using the -g option. Each directive should end with `;`. For example: `worker_processes 4; timer_resolution 100ms;`. Advanced configuration to be used only if instructed by XSOAR Support."
  display: NGINX Global Directives
  name: nginx_global_directives
  type: 0
  required: false
- additionalinfo: "NGINX server configuration. To be used instead of the default NGINX_SERVER_CONF used in the integration code. Advanced configuration to be used only if instructed by XSOAR Support."
  display: NGINX Server Conf
  name: nginx_server_conf
  type: 12
  required: false
description: Deprecated. Use the Generic Export Indicators Service integration instead. Use the Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators.
display: Export Indicators Service (Deprecated)
deprecated: true
name: ExportIndicators
script:
  commands:
  - arguments:
    - description: 'The query used to retrieve indicators from the system. Leave empty to use the query from the integration parameters. '
      name: query
    - auto: PREDEFINED
      defaultValue: text
      description: The output format. Can be "text", "json", "json-seq", "csv", "XOSAR json", "XSOAR json-seq", "XSOAR csv", "PAN-OS URL", "McAfee Web Gateway" and "Symantec ProxySG".
      name: format
      predefined:
      - text
      - json
      - json-seq
      - csv
      - XSOAR json
      - XSOAR json-seq
      - XSOAR csv
      - McAfee Web Gateway
      - Symantec ProxySG
      - PAN-OS URL
    - description: The maximum number of entries in the output. If no value is provided, will use the value specified in the "List Size" parameter configured in the instance configuration.
      name: list_size
    - defaultValue: 'false'
      description: Whether to print the indicators. If set to "true" will print the indicators that were saved to the Export Indicators Service. The default value is "false".
      name: print_indicators
      predefined:
      - 'false'
      - 'true'
      required: true
    - defaultValue: '0'
      description: The starting entry index from which to export the indicators.
      name: offset
    - auto: PREDEFINED
      defaultValue: string
      description: For use with McAfee Web Gateway format to indicate the list type.
      name: mwg_type
      predefined:
      - string
      - applcontrol
      - dimension
      - category
      - ip
      - mediatype
      - number
      - regex
    - auto: PREDEFINED
      defaultValue: 'False'
      description: For use with PAN-OS URL format - if True, will strip the port from URLs. If False, - URLs with ports will be ignored.
      name: strip_port
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: 'False'
      description: For use with PAN-OS URL format - if True, any URL entry that is not compliant with PAN-OS EDL URL format is dropped instead of being rewritten.
      name: drop_invalids
      predefined:
      - 'False'
      - 'True'
    - defaultValue: bc_category
      description: For use with Symantec ProxySG format - set the default category for the output.
      name: category_default
    - description: For use with Symantec ProxySG format - set the categories that should be listed in the output. If not set, will list all existing categories.
      name: category_attribute
    - auto: PREDEFINED
      defaultValue: Don't Collapse
      description: Whether to collapse IPs to ranges or CIDRs.
      name: collapse_ips
      predefined:
      - Don't Collapse
      - To CIDRs
      - To Ranges
    - auto: PREDEFINED
      defaultValue: 'False'
      description: If True, will output csv and XSOAR-csv formats as textual web pages.
      name: csv_text
      predefined:
      - 'False'
      - 'True'
    - description: The field by which to sort the indicators by.
      name: sort_field
    - auto: PREDEFINED
      description: The direction by which to order the indicators. The options are `asc` or `desc`.
      name: sort_order
      predefined:
      - asc
      - desc
    description: Updates values stored in the Export Indicators Service (only avaialable On-Demand).
    name: eis-update
  dockerimage: demisto/flask-nginx:1.0.0.23674
  longRunning: true
  longRunningPort: true
  script: '-'
  subtype: python3
  type: python
tests:
- Test_export_indicators_service
fromversion: 5.5.0
triggers:
  - conditions:
      - name: engine
        operator: not_exists
      - name: isEngineGroup
        operator: not_exists
    effects:
      - name: longRunningPort
        action:
          hidden: true
          required: false