Using XTI in playbooks

Automate XTI indicator triage, enrichment, and response with supported playbook commands in Cortex AgentiX.

Extended Threat Intelligence (XTI) utilizes existing Threat Intel Management (TIM) to automate triage, enrichment, and response for threat intel use cases.

Playbook commands supported by XTI

The following built-in commands (also referred to as system commands) can be used with XTI.

The supported commands are:

• createNewIndicator: Create an indicator (IP, domain, file hash, or URL).

The createNewIndicator command is only supported with indicator type=IP|Domain|File|URL.

• setIndicator: Update an indicator (IP, domain, file hash, or URL).

Related links

For more information on specific built-in commands, see the in-product Script Helper available from Incident Response → Automation → Scripts → Script Helper.

For general information about playbooks, see Playbooks.