args:
- defaultValue: 1h
  description: Get indicators updated within this duration (from now).
  name: since
- description: Maximum number of results to return.
  name: limit
- auto: PREDEFINED
  defaultValue: 'false'
  description: If true, the indicators that were updated to be false positive will be added to allow list in Demisto. No new indicators will be created.
  name: delete_false_positive
  predefined:
  - 'true'
  - 'false'
- auto: PREDEFINED
  description: Filter by indicator type.
  name: indicator_type
  predefined:
  - Domain
  - URL
  - Attachment
- auto: PREDEFINED
  defaultValue: 'false'
  description: Removes the query string part from indicators, when the rules can be applied.
  name: remove_query
  predefined:
  - 'true'
  - 'false'
- auto: PREDEFINED
  defaultValue: 'false'
  description: Removes the protocol part from indicators, when the rule can be applied.
  name: remove_protocol
  predefined:
  - 'true'
  - 'false'
comment: |-
  Populate indicators by the PhishLabs IOC global feed.

  This automation runs using the default Limited User role, unless you explicitly change the permissions.
  For more information, see the section about permissions here:
  - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
  - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
  - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
commonfields:
  id: PhishLabsPopulateIndicators
  version: -1
enabled: true
name: PhishLabsPopulateIndicators
script: '-'
tags:
- PhishLabs
timeout: 3.6µs
type: python
dockerimage: demisto/python3:3.12.13.10116658
subtype: python3
dependson:
  must: []
  should:
  - PhishLabs IOC|||phishlabs-global-feed
fromversion: 5.0.0
tests:
- No tests (auto formatted)