> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/indicators-commands.md).

# Indicators Commands

* [addIOCRule](#addiocrule)
* [disableIOCs](#disableiocs)
* [enableIOCs](#enableiocs)
* [pushIOCs](#pushiocs)
* [getIOCRules](#getiocrules)
* [getIOCBIOCSuppressionRules](#getiocbiocsuppressionrules)

#### addIOCRule

***

Adds an IOC rule. When ioc\_object is provided, other arguments are ignored. For multiple vendors, use ioc\_object in JSON format. Adding a rule with the same IOC but different parameters updates the existing rule.

<details>

<summary>Arguments</summary>

| Argument Name       | Description                                                                                                                        | Required |
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | -------- |
| indicator           | The indicator value to ingest (e.g., IP address, domain, hash). Required when ioc\_object is not provided.                         | Optional |
| type                | The indicator type. Required when ioc\_object is not provided. Possible values are: HASH, IP, PATH, DOMAIN\_NAME, FILENAME.        | Optional |
| severity            | The indicator severity. Required when ioc\_object is not provided. Possible values are: INFO, LOW, MEDIUM, HIGH, CRITICAL.         | Optional |
| expiration\_date    | Expiration as epoch milliseconds, relative time (e.g., '7 days'), or 'Never'. If omitted, uses the default for the indicator type. | Optional |
| comment             | A comment to associate with the indicator.                                                                                         | Optional |
| reputation          | The indicator reputation. Possible values are: GOOD, BAD, SUSPICIOUS, UNKNOWN.                                                     | Optional |
| reliability         | The indicator reliability rating (A is most reliable, F is least). Possible values are: A, B, C, D, E, F.                          | Optional |
| class               | The indicator classification (e.g., 'Malware').                                                                                    | Optional |
| vendor\_name        | The name of the vendor reporting this indicator.                                                                                   | Optional |
| vendor\_reputation  | The vendor's reputation. Required when vendor\_name is provided. Possible values are: GOOD, BAD, SUSPICIOUS, UNKNOWN.              | Optional |
| vendor\_reliability | The vendor's reliability rating (A-F). Required when vendor\_reputation is provided. Possible values are: A, B, C, D, E, F.        | Optional |
| input\_format       | The format for sending the IOC data to the API. Possible values are: CSV, JSON. Default is JSON.                                   | Optional |
| ioc\_object         | A pre-built IOC object in JSON or CSV format. When provided, all other arguments are ignored.                                      | Optional |

</details>

<details>

<summary>Outputs</summary>

**Core.Indicator.indicator** *string*

String that identifies the indicator that was ingested into XSIAM.

**Core.Indicator.type** *string*

Keyword identifying the type of indicator.

**Core.Indicator.severity** *string*

Keyword identifying the indicator's severity.

**Core.Indicator.expiration\_date** *unknown*

Integer representing the indicator's expiration timestamp.

**Core.Indicator.comment** *string*

Comment string.

**Core.Indicator.reputation** *string*

Keyword representing the indicator's reputation.

**Core.Indicator.reliability** *string*

Keyword representing the indicator's reliability rating.

**Core.Indicator.class** *string*

String representing the indicator class.

**Core.Indicator.vendors** *unknown*

List representing the vendors who reported this indicator.

</details>

#### disableIOCs

***

Disables IOC indicators in the Cortex XDR. Only supports indicators that were previously pushed using the `pushIOCs` command.

<details>

<summary>Arguments</summary>

| Argument Name | Description                                      | Required |
| ------------- | ------------------------------------------------ | -------- |
| indicators    | A comma-separated list of indicators to disable. | Required |

</details>

**Outputs**

There are no outputs for this command.

#### enableIOCs

***

Enables IOC indicators in the Cortex XDR. Only supports indicators that were previously pushed using the `pushIOCs` command.

<details>

<summary>Arguments</summary>

| Argument Name | Description                                     | Required |
| ------------- | ----------------------------------------------- | -------- |
| indicators    | A comma-separated list of indicators to enable. | Required |

</details>

**Outputs**

There are no outputs for this command.

#### pushIOCs

***

Pushes indicators from Threat Management to Detection IOC Rules. Supported indicator types: hash, IP, domain, and file name.

<details>

<summary>Arguments</summary>

| Argument Name | Description                                                                                                               | Required |
| ------------- | ------------------------------------------------------------------------------------------------------------------------- | -------- |
| indicators    | A comma-separated list of indicators to push. Leave empty to push all recently modified IOCs.                             | Optional |
| severity      | Severity level for pushed IOCs. Possible values are: info, low, medium, high, critical, unknown. Default is low.          | Optional |
| query         | Query to filter IOCs when no indicator is specified. Default is reputation:Bad and (type:File or type:Domain or type:IP). | Optional |

</details>

**Outputs**

There are no outputs for this command.

#### getIOCRules

***

Returns a list of IOC rules, with optional filtering based on the provided filter criteria.

<details>

<summary>Arguments</summary>

| Argument Name  | Description                                                                                                             | Required |
| -------------- | ----------------------------------------------------------------------------------------------------------------------- | -------- |
| indicator      | Filters results by the indicator value. Supports partial matching.                                                      | Optional |
| type           | Filters results by the indicator type. Possible values are: Domain Name, Email Address, File Name, Hash, IP, Path, URL. | Optional |
| severity       | Filters results by the severity level. Possible values are: info, low, medium, high, critical, unknown.                 | Optional |
| filter\_object | A JSON-encoded string representing a raw filter object. Overrides all other filter arguments when provided.             | Optional |
| limit          | The maximum number of results to return. Ignored when `page` or `page_size` is provided. Default is 50.                 | Optional |
| page\_size     | The number of results per page. When provided, manual pagination is used and `limit` is ignored.                        | Optional |
| page           | The page number to return (0-based). When provided, manual pagination is used and `limit` is ignored.                   | Optional |

</details>

<details>

<summary>Outputs</summary>

**Core.IOC.rule\_id** *number*

The unique identifier of the IOC rule.

**Core.IOC.indicator** *string*

The indicator value of the IOC rule.

**Core.IOC.type** *string*

The type of indicator.

**Core.IOC.severity** *string*

The severity of the indicator.

**Core.IOC.status** *string*

The status of the IOC rule.

**Core.IOC.comment** *string*

The comment associated with the IOC rule.

**Core.IOC.reputation** *string*

The reputation of the indicator.

**Core.IOC.reliability** *string*

The reliability rating of the indicator.

**Core.IOC.source** *string*

The source that created the IOC rule.

**Core.IOC.insert\_time** *number*

The timestamp when the rule was inserted.

**Core.IOC.modify\_time** *number*

The timestamp when the rule was last modified.

**Core.IOC.expiration\_time** *number*

The expiration timestamp of the rule.

**Core.IOC.number\_of\_hits** *number*

The number of times the rule has been triggered.

**Core.IOC.klass** *unknown*

The class of the IOC rule.

**Core.IOC.vendors** *unknown*

The vendors associated with the IOC rule.

**Core.IOC.is\_default\_ttl** *boolean*

Whether the rule uses the default TTL.

**Core.IOC.rule\_ttl** *number*

The time-to-live value of the IOC rule.

**Core.IOC.marked\_deleted** *number*

Whether the rule is marked for deletion.

**Core.IOC.bs\_status** *string*

The backend sync status of the IOC rule.

**Core.IOC.bs\_ts** *number*

The backend sync timestamp of the IOC rule.

**Core.IOC.bs\_retries** *number*

The number of backend sync retries.

**Core.IOC.indicator\_last\_modified\_ts** *number*

The timestamp when the indicator was last modified.

</details>

#### getIOCBIOCSuppressionRules

***

Returns a list of IOC/BIOC suppression rules, with optional filtering based on the provided filter criteria.

<details>

<summary>Arguments</summary>

| Argument Name  | Description                                                                                                 | Required |
| -------------- | ----------------------------------------------------------------------------------------------------------- | -------- |
| filter\_object | A JSON-encoded string representing a raw filter object. Overrides all other filter arguments when provided. | Optional |
| limit          | The maximum number of results to return. Ignored when 'page' or 'page\_size' is provided. Default is 50.    | Optional |
| page\_size     | The number of results per page. When provided, manual pagination is used and 'limit' is ignored.            | Optional |
| page           | The page number to return (0-based). When provided, manual pagination is used and 'limit' is ignored.       | Optional |

</details>

<details>

<summary>Outputs</summary>

**Core.SuppressionRule.exception\_id** *number*

The unique identifier of the suppression rule.

**Core.SuppressionRule.rule\_name** *string*

The name of the suppression rule.

**Core.SuppressionRule.comment** *string*

The comment associated with the suppression rule.

**Core.SuppressionRule.created\_by** *string*

The user who created the suppression rule.

**Core.SuppressionRule.enabled** *boolean*

Whether the suppression rule is enabled.

**Core.SuppressionRule.is\_wildcard** *boolean*

Whether the suppression rule is a wildcard exception.

**Core.SuppressionRule.is\_ioc\_wildcard** *boolean*

Whether the suppression rule is an IOC wildcard exception.

**Core.SuppressionRule.is\_xti\_wildcard** *boolean*

Whether the suppression rule is an XTI wildcard exception.

**Core.SuppressionRule.raw\_indicator** *string*

The raw JSON indicator string of the suppression rule.

**Core.SuppressionRule.indicator\_text** *unknown*

The human-readable indicator text tokens of the suppression rule.

**Core.SuppressionRule.entity\_details** *unknown*

The entity details associated with the suppression rule.

**Core.SuppressionRule.insert\_time** *number*

The timestamp when the rule was created.

**Core.SuppressionRule.modify\_time** *number*

The timestamp when the rule was last modified.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/indicators-commands.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.