Using XTI in playbooks

Use Cortex XSIAM playbooks to automate XTI indicator triage, enrichment, and response with supported commands.

Extended Threat Intelligence (XTI) utilizes existing Threat Intel Management (TIM) to automate triage, enrichment, and response for threat intel use cases.

Playbook commands supported by XTI

The following built-in commands (also referred to as system commands) can be used with XTI.

The supported commands are:

• createNewIndicator
• setIndicator

Related links

For more information on specific built-in commands, see the in-product Script Helper available from Incident Response → Automation → Scripts → Script Helper.

For general information about playbooks, see Playbooks.