commonfields:
  id: IsMaliciousIndicatorFound
  version: -1
name: IsMaliciousIndicatorFound
script: ''
type: javascript
tags:
- Utility
- Condition
comment: Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found.
enabled: true
args:
- name: includeSuspicious
  default: true
  auto: PREDEFINED
  predefined:
  - "yes"
  - "no"
  description: Whether to check suspicious indicators. Default is "no".
  defaultValue: "no"
- name: queryIndicators
  auto: PREDEFINED
  predefined:
  - "yes"
  - "no"
  description: Query all indicators in an investigation (relevant if running in a sub-playbook).
  defaultValue: "yes"
- name: maliciousQueryOverride
  description: Whether to override the default query for malicious indicators in Demisto (Indicators page).
- name: includeManual
  auto: PREDEFINED
  predefined:
  - "yes"
  - "no"
  description: Whether to check manually edited indicators. Default is "yes".
  defaultValue: "yes"
outputs:
- contextPath: "yes"
  description: Whether any malicious indicators were found in the investigation.
- contextPath: "no"
  description: Whether any malicious indicators were found in the investigation.
scripttarget: 0
runas: DBotWeakRole
fromversion: 5.0.0