Indicators Commands

• addIOCRule
• disableIOCs
• enableIOCs
• pushIOCs
• getIOCRules
• getIOCBIOCSuppressionRules

addIOCRule

---

Adds an IOC rule. When ioc_object is provided, other arguments are ignored. For multiple vendors, use ioc_object in JSON format. Adding a rule with the same IOC but different parameters updates the existing rule.

Arguments

Argument Name	Description	Required
indicator	The indicator value to ingest (e.g., IP address, domain, hash). Required when ioc_object is not provided.	Optional
type	The indicator type. Required when ioc_object is not provided. Possible values are: HASH, IP, PATH, DOMAIN_NAME, FILENAME.	Optional
severity	The indicator severity. Required when ioc_object is not provided. Possible values are: INFO, LOW, MEDIUM, HIGH, CRITICAL.	Optional
expiration_date	Expiration as epoch milliseconds, relative time (e.g., '7 days'), or 'Never'. If omitted, uses the default for the indicator type.	Optional
comment	A comment to associate with the indicator.	Optional
reputation	The indicator reputation. Possible values are: GOOD, BAD, SUSPICIOUS, UNKNOWN.	Optional
reliability	The indicator reliability rating (A is most reliable, F is least). Possible values are: A, B, C, D, E, F.	Optional
class	The indicator classification (e.g., 'Malware').	Optional
vendor_name	The name of the vendor reporting this indicator.	Optional
vendor_reputation	The vendor's reputation. Required when vendor_name is provided. Possible values are: GOOD, BAD, SUSPICIOUS, UNKNOWN.	Optional
vendor_reliability	The vendor's reliability rating (A-F). Required when vendor_reputation is provided. Possible values are: A, B, C, D, E, F.	Optional
input_format	The format for sending the IOC data to the API. Possible values are: CSV, JSON. Default is JSON.	Optional
ioc_object	A pre-built IOC object in JSON or CSV format. When provided, all other arguments are ignored.	Optional

Outputs

Core.Indicator.indicator string

String that identifies the indicator that was ingested into XSIAM.

Core.Indicator.type string

Keyword identifying the type of indicator.

Core.Indicator.severity string

Keyword identifying the indicator's severity.

Core.Indicator.expiration_date unknown

Integer representing the indicator's expiration timestamp.

Core.Indicator.comment string

Comment string.

Core.Indicator.reputation string

Keyword representing the indicator's reputation.

Core.Indicator.reliability string

Keyword representing the indicator's reliability rating.

Core.Indicator.class string

String representing the indicator class.

Core.Indicator.vendors unknown

List representing the vendors who reported this indicator.

disableIOCs

---

Disables IOC indicators in the Cortex XDR. Only supports indicators that were previously pushed using the pushIOCs command.

Arguments

Argument Name	Description	Required
indicators	A comma-separated list of indicators to disable.	Required

Outputs

There are no outputs for this command.

enableIOCs

---

Enables IOC indicators in the Cortex XDR. Only supports indicators that were previously pushed using the pushIOCs command.

Arguments

Argument Name	Description	Required
indicators	A comma-separated list of indicators to enable.	Required

Outputs

There are no outputs for this command.

pushIOCs

---

Pushes indicators from Threat Management to Detection IOC Rules. Supported indicator types: hash, IP, domain, and file name.

Arguments

Argument Name	Description	Required
indicators	A comma-separated list of indicators to push. Leave empty to push all recently modified IOCs.	Optional
severity	Severity level for pushed IOCs. Possible values are: info, low, medium, high, critical, unknown. Default is low.	Optional
query	Query to filter IOCs when no indicator is specified. Default is reputation:Bad and (type:File or type:Domain or type:IP).	Optional

Outputs

There are no outputs for this command.

getIOCRules

---

Returns a list of IOC rules, with optional filtering based on the provided filter criteria.

Arguments

Argument Name	Description	Required
indicator	Filters results by the indicator value. Supports partial matching.	Optional
type	Filters results by the indicator type. Possible values are: Domain Name, Email Address, File Name, Hash, IP, Path, URL.	Optional
severity	Filters results by the severity level. Possible values are: info, low, medium, high, critical, unknown.	Optional
filter_object	A JSON-encoded string representing a raw filter object. Overrides all other filter arguments when provided.	Optional
limit	The maximum number of results to return. Ignored when page or page_size is provided. Default is 50.	Optional
page_size	The number of results per page. When provided, manual pagination is used and limit is ignored.	Optional
page	The page number to return (0-based). When provided, manual pagination is used and limit is ignored.	Optional

Outputs

Core.IOC.rule_id number

The unique identifier of the IOC rule.

Core.IOC.indicator string

The indicator value of the IOC rule.

Core.IOC.type string

The type of indicator.

Core.IOC.severity string

The severity of the indicator.

Core.IOC.status string

The status of the IOC rule.

Core.IOC.comment string

The comment associated with the IOC rule.

Core.IOC.reputation string

The reputation of the indicator.

Core.IOC.reliability string

The reliability rating of the indicator.

Core.IOC.source string

The source that created the IOC rule.

Core.IOC.insert_time number

The timestamp when the rule was inserted.

Core.IOC.modify_time number

The timestamp when the rule was last modified.

Core.IOC.expiration_time number

The expiration timestamp of the rule.

Core.IOC.number_of_hits number

The number of times the rule has been triggered.

Core.IOC.klass unknown

The class of the IOC rule.

Core.IOC.vendors unknown

The vendors associated with the IOC rule.

Core.IOC.is_default_ttl boolean

Whether the rule uses the default TTL.

Core.IOC.rule_ttl number

The time-to-live value of the IOC rule.

Core.IOC.marked_deleted number

Whether the rule is marked for deletion.

Core.IOC.bs_status string

The backend sync status of the IOC rule.

Core.IOC.bs_ts number

The backend sync timestamp of the IOC rule.

Core.IOC.bs_retries number

The number of backend sync retries.

Core.IOC.indicator_last_modified_ts number

The timestamp when the indicator was last modified.

getIOCBIOCSuppressionRules

---

Returns a list of IOC/BIOC suppression rules, with optional filtering based on the provided filter criteria.

Arguments

Argument Name	Description	Required
filter_object	A JSON-encoded string representing a raw filter object. Overrides all other filter arguments when provided.	Optional
limit	The maximum number of results to return. Ignored when 'page' or 'page_size' is provided. Default is 50.	Optional
page_size	The number of results per page. When provided, manual pagination is used and 'limit' is ignored.	Optional
page	The page number to return (0-based). When provided, manual pagination is used and 'limit' is ignored.	Optional

Outputs

Core.SuppressionRule.exception_id number

The unique identifier of the suppression rule.

Core.SuppressionRule.rule_name string

The name of the suppression rule.

Core.SuppressionRule.comment string

The comment associated with the suppression rule.

Core.SuppressionRule.created_by string

The user who created the suppression rule.

Core.SuppressionRule.enabled boolean

Whether the suppression rule is enabled.

Core.SuppressionRule.is_wildcard boolean

Whether the suppression rule is a wildcard exception.

Core.SuppressionRule.is_ioc_wildcard boolean

Whether the suppression rule is an IOC wildcard exception.

Core.SuppressionRule.is_xti_wildcard boolean

Whether the suppression rule is an XTI wildcard exception.

Core.SuppressionRule.raw_indicator string

The raw JSON indicator string of the suppression rule.

Core.SuppressionRule.indicator_text unknown

The human-readable indicator text tokens of the suppression rule.

Core.SuppressionRule.entity_details unknown

The entity details associated with the suppression rule.

Core.SuppressionRule.insert_time number

The timestamp when the rule was created.

Core.SuppressionRule.modify_time number

The timestamp when the rule was last modified.