commonfields:
  id: CreateNewIndicatorsOnly
  version: -1
name: CreateNewIndicatorsOnly
script: ''
type: python
tags:
- Utility
comment: Create indicators to the Threat Intel database only if they are not registered. All submitted indicators will be associated with the parent incident. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
enabled: true
args:
- name: indicator_values
  description: |
    Comma-separated values are not supported because indicator values may contain commas. To pass multiple indicators, provide an array from context.
  isArray: true
- name: type
  auto: PREDEFINED
  predefined:
  - IP
  - CIDR
  - IPv6
  - IPv6CIDR
  - Domain
  - Email
  - URL
  - File
  - File MD5
  - File SHA256
  - File SHA1
  - Account
  - CVE
  - Host
  - ssdeep
  - Registry Key
  description: The indicator type of the indicators.
- name: source
  description: The indicator source.
- name: verdict
  auto: PREDEFINED
  predefined:
  - Unknown
  - Benign
  - Suspicious
  - Malicious
  description: The indicator reputation.
- name: tags
  description: The tags to add to the new indicators.
  isArray: true
- name: associate_to_current
  auto: PREDEFINED
  predefined:
    - "true"
    - "false"
  defaultValue: "false"
  description: Whether to force the association of the indicator to the current incident.
- name: verbose
  auto: PREDEFINED
  predefined:
  - "true"
  - "false"
  description: Whether to output additional messages as readable output.
outputs:
- contextPath: CreateNewIndicatorsOnly.ID
  description: The indicator ID.
  type: string
- contextPath: CreateNewIndicatorsOnly.Value
  description: The indicator value.
  type: string
- contextPath: CreateNewIndicatorsOnly.Type
  description: The indicator type.
  type: string
- contextPath: CreateNewIndicatorsOnly.Score
  description: The indicator score.
  type: number
- contextPath: CreateNewIndicatorsOnly.CreationStatus
  description: The status of the indicator requested to add. Value is either new, existing, or unavailable.
  type: string
scripttarget: 0
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
runas: DBotWeakRole
fromversion: 6.5.0
tests:
- No tests (auto formatted)