> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/indicators-commands.md).

# Indicators Commands

* [addIOCRule](#addiocrule)
* [disableIOCs](#disableiocs)
* [enableIOCs](#enableiocs)
* [pushIOCs](#pushiocs)

#### addIOCRule

***

Adds an IOC rule. When ioc\_object is provided, other arguments are ignored. For multiple vendors, use ioc\_object in JSON format. Adding a rule with the same IOC but different parameters updates the existing rule.

<details>

<summary>Arguments</summary>

| Argument Name       | Description                                                                                                                        | Required |
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | -------- |
| indicator           | The indicator value to ingest (e.g., IP address, domain, hash). Required when ioc\_object is not provided.                         | Optional |
| type                | The indicator type. Required when ioc\_object is not provided. Possible values are: HASH, IP, PATH, DOMAIN\_NAME, FILENAME.        | Optional |
| severity            | The indicator severity. Required when ioc\_object is not provided. Possible values are: INFO, LOW, MEDIUM, HIGH, CRITICAL.         | Optional |
| expiration\_date    | Expiration as epoch milliseconds, relative time (e.g., '7 days'), or 'Never'. If omitted, uses the default for the indicator type. | Optional |
| comment             | A comment to associate with the indicator.                                                                                         | Optional |
| reputation          | The indicator reputation. Possible values are: GOOD, BAD, SUSPICIOUS, UNKNOWN.                                                     | Optional |
| reliability         | The indicator reliability rating (A is most reliable, F is least). Possible values are: A, B, C, D, E, F.                          | Optional |
| class               | The indicator classification (e.g., 'Malware').                                                                                    | Optional |
| vendor\_name        | The name of the vendor reporting this indicator.                                                                                   | Optional |
| vendor\_reputation  | The vendor's reputation. Required when vendor\_name is provided. Possible values are: GOOD, BAD, SUSPICIOUS, UNKNOWN.              | Optional |
| vendor\_reliability | The vendor's reliability rating (A-F). Required when vendor\_reputation is provided. Possible values are: A, B, C, D, E, F.        | Optional |
| input\_format       | The format for sending the IOC data to the API. Possible values are: CSV, JSON. Default is JSON.                                   | Optional |
| ioc\_object         | A pre-built IOC object in JSON or CSV format. When provided, all other arguments are ignored.                                      | Optional |

</details>

<details>

<summary>Outputs</summary>

**Core.Indicator.indicator** *string*

String that identifies the indicator that was ingested into XSIAM.

**Core.Indicator.type** *string*

Keyword identifying the type of indicator.

**Core.Indicator.severity** *string*

Keyword identifying the indicator's severity.

**Core.Indicator.expiration\_date** *unknown*

Integer representing the indicator's expiration timestamp.

**Core.Indicator.comment** *string*

Comment string.

**Core.Indicator.reputation** *string*

Keyword representing the indicator's reputation.

**Core.Indicator.reliability** *string*

Keyword representing the indicator's reliability rating.

**Core.Indicator.class** *string*

String representing the indicator class.

**Core.Indicator.vendors** *unknown*

List representing the vendors who reported this indicator.

</details>

#### disableIOCs

***

Disables IOC indicators in the Cortex XDR. Only supports indicators that were previously pushed using the `pushIOCs` command.

<details>

<summary>Arguments</summary>

| Argument Name | Description                                      | Required |
| ------------- | ------------------------------------------------ | -------- |
| indicators    | A comma-separated list of indicators to disable. | Required |

</details>

**Outputs**

There are no outputs for this command.

#### enableIOCs

***

Enables IOC indicators in the Cortex XDR. Only supports indicators that were previously pushed using the `pushIOCs` command.

<details>

<summary>Arguments</summary>

| Argument Name | Description                                     | Required |
| ------------- | ----------------------------------------------- | -------- |
| indicators    | A comma-separated list of indicators to enable. | Required |

</details>

**Outputs**

There are no outputs for this command.

#### pushIOCs

***

Pushes indicators from Threat Management to Detection IOC Rules. Supported indicator types: hash, IP, domain, and file name.

<details>

<summary>Arguments</summary>

| Argument Name | Description                                                                                                               | Required |
| ------------- | ------------------------------------------------------------------------------------------------------------------------- | -------- |
| indicators    | A comma-separated list of indicators to push. Leave empty to push all recently modified IOCs.                             | Optional |
| severity      | Severity level for pushed IOCs. Possible values are: info, low, medium, high, critical, unknown. Default is low.          | Optional |
| query         | Query to filter IOCs when no indicator is specified. Default is reputation:Bad and (type:File or type:Domain or type:IP). | Optional |

</details>

**Outputs**

There are no outputs for this command.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/indicators-commands.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.