> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/run-indicator-extraction-in-the-cli.md).

# Run indicator extraction in the CLI

Use Cortex XSIAM War Room CLI commands to extract, enrich, and run reputation checks on indicators.

Use Cortex XSIAM issue War Room CLI commands to extract indicators, enrich existing indicators, and run reputation checks. The following commands run at the issue level:

### Extract indicators in the War Room CLI

* **`!extractIndicators`**

  If you want to extract indicators from non-War-Room-entry sources (such as extracting from files), use the **`!extractIndicators`** command from the issue War Room CLI. The command does not create indicators but extracts them only. Use the command to do the following:

  * Validate regex: Test a specific string to see if the relevant indicators are extracted correctly, such as a URL.
  * In a playbook or automation: The command extracts indicators in a playbook or automation non-war-room-source, and potentially also creates and enriches them (if required).

  You can extract from the following:

  * A specified entry (an entry ID)
  * Investigation (Investigation ID)
  * Text
  * File path

  For example, type **`!extractIndicators text="some text 1.1.1.1 something" Auto extract=inline`**. The entry text contains the text of the indicators, which is extracted and enriched. You can also extract indicators by adding the auto-extract parameter with the script and the mode for which you are setting it up. For example, **`!ReadFile entryId=826@101 auto-extract=inline`**. Usually, when using the CLI, you want to disable indicator extraction. For example, if you return internal/private data to the War Room, and you do not want it to be extracted and enriched in third-party services, add auto-extract=none to your CLI command.

### Enrich indicators in the War Room CLI

* **`!enrichIndicators`**

  The **`!enrichIndicators`** command is usually used when you want to batch enrich indicators. This command works on existing indicators only (it does not create them on its own). When running the command, the relevant enrichment command is triggered (such as **`!ip`**), which is based on the indicator type that is found. The data is saved to context and to the indicator.

{% hint style="info" %}
Triggering enrichment on a substantial amount of indicators can take time (since it's activating all enrichment integrations per indicator) and can result in performance degradation.
{% endhint %}

### Run indicator reputation commands

* Reputation commands, such as **`!ip`**, can work on existing and non-existing indicators. If extraction is on, data is saved to the indicator and issue context. Otherwise, it is saved only to context because enrichment commands always trigger the mapping flow. Playbook tasks use `none` as the default extraction configuration.\
  The indicator does not need to exist to run the reputation command, as the command uses a third-party threat intel integration, such as Unit 42 Intelligence, IPinfo, etc. You can also click the Enrich indicator button in the indicator layout.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/run-indicator-extraction-in-the-cli.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.