args:
- description: The query for the Indicators that you want to export. (e.g. type:IP and reputation:Bad and expirationStatus:active). You can and should generate the query from the Indicators search screen.
  name: query
  required: true
- defaultValue: "7"
  description: Indicator last seen days  (default is 7).  Needs to be a number.
  name: seenDays
- description: 'Comma separated list of columns (fields) for the CSV.  (Default is: id,indicator_type,value,source,score,relatedIncCount,setBy,sourceBrands,modified).'
  name: columns
comment: This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.
commonfields:
  id: ExportIndicatorsToCSV
  version: -1
contentitemexportablefields:
  contentitemfields:
    fromServerVersion: ""
dependson:
  must:
  - core-api-post
  - core-api-get
dockerimage: demisto/python3:3.12.13.10404775
enabled: true
name: ExportIndicatorsToCSV
runas: DBotWeakRole
script: ''
scripttarget: 0
subtype: python3
tags:
- Utility
type: python
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform
supportedModules:
- agentix
- cloud
- cloud_runtime_security
- cloud_posture
- xsiam
- edr
tests:
- No tests (auto formatted)