args:
- description: A JSON array of indicator values to filter the search results (e.g., `["1.1.1.1", "8.8.8.8"]`, `["https://unit42.paloaltonetworks.com", "https://t.co/i/adsct"]`).
  name: value
  required: false
  isArray: true
- description: 'The expiration status of the indicator.'
  name: expirationStatus
  required: false
  predefined:
  - expired
  - active
- description: 'The type of the indicator to search can be a single value or a comma separated list of values.'
  name: type
  required: false
  isArray: true
- description: 'The IssuesIDs that are linked to the indicator can be a single value or a comma separated list of values.'
  name: IssuesIDs
  required: false
  isArray: true
- defaultValue: "25"
  description: The number of indicators to return, defaults to a max of 25.
  name: size
- description: 'A comma-separated list of indicator verdicts to filter the search results by. Options: Malicious, Suspicious, Benign, or Unknown.'
  name: verdict
  required: false
comment: |-
  This script searches indicators by specified fields.
commonfields:
  id: SearchIndicatorAgentix
  version: -1
contentitemexportablefields:
  contentitemfields:
    fromServerVersion: ""
dockerimage: demisto/python3:3.12.13.10116658
enabled: true
name: SearchIndicatorAgentix
outputs:
- contextPath: foundIndicators.id
  description: The id of the indicator in the XSOAR database.
- contextPath: foundIndicators.indicator_type
  description: The type of Indicator (i.e. IP, Domain, URL, etc).
- contextPath: foundIndicators.value
  description: The value of the Indicator.
- contextPath: foundIndicators.score
  description: The numeric score of the indicator (0 = Unknown, 1 = Benign, 2 = Suspicious, 3 = Malicious).
- contextPath: foundIndicators.verdict
  description: The human readable score/verdict of the Indicator.
- contextPath: foundIndicators.IssueIDs
  description: The investigations related to the indicator.
- contextPath: foundIndicators.expirationStatus
  description: The expiration status of the indicator.
- contextPath: foundIndicators.lastSeen
  description: The timestamp of the last time the indicator was sensitive.

runas: DBotWeakRole
script: ''
scripttarget: 0
subtype: python3
isInternal: true
tags:
- Utility
type: python
dependson:
  must:
  - findIndicators
fromversion: 6.5.0
tests:
- No tests (auto formatted)
marketplaces:
  - platform