> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators.md). # Configure Indicators - [Indicator Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization.md): Customize indicator types, fields, and layouts in Cortex XSOAR 6.14. - [Indicator Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types.md): Learn how Cortex XSOAR 6.14 identifies and manages indicator types. - [File Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/file-indicators.md): Configure file indicators and hash-based indicators in Cortex XSOAR 6.14. - [Create an Indicator Type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/create-an-indicator-type.md): Create custom indicator types alongside system types in Cortex XSOAR 6.14. - [Indicator Type Profile](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/indicator-type-profile.md): Configure indicator type profiles and fields in Cortex XSOAR 6.14. - [Formatting Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/formatting-scripts.md): Use formatting scripts to validate input and format indicators in Cortex XSOAR 6.14. - [Enhancement Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/enhancement-scripts.md): Use enhancement scripts to enrich indicators in Cortex XSOAR 6.14. - [Reputation Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/reputation-scripts.md): Use reputation scripts for indicator enrichment in Cortex XSOAR 6.14. - [Reputation Commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/reputation-commands.md): Learn how reputation commands return indicator verdicts in Cortex XSOAR 6.14. - [Map Custom Indicator Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/map-custom-indicator-fields.md): Map custom indicator fields to context data in Cortex XSOAR 6.14. - [Indicator Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-fields.md): Configure indicator fields for specific or all types in Cortex XSOAR 6.14. - [Create a Custom Indicator Field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field.md): Create custom indicator fields in Cortex XSOAR 6.14. - [Indicator Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-fields/indicator-field-trigger-scripts.md): Trigger scripts when indicator fields change in Cortex XSOAR 6.14. - [Indicator Fields Structure](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-fields/indicator-fields-structure.md): Understand STIX-aligned indicator field structures in Cortex XSOAR 6.14. - [Indicator Layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-layouts.md): Learn about indicator view layouts in Cortex XSOAR 6.14. - [Customize an Indicator Type Layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-layouts/customize-an-indicator-type-layout.md): Customize layouts for each indicator type in Cortex XSOAR 6.14. - [Add a Script in the Indicator Layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-layouts/add-a-script-in-the-indicator-layout.md): Add automation script content to indicator layouts in Cortex XSOAR 6.14. - [Indicator Extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction.md): Configure and run indicator extraction and enrichment in Cortex XSOAR 6.14. - [Indicator Extraction Modes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/indicator-extraction-modes.md): Configure indicator extraction modes in Cortex XSOAR 6.14. - [Create Indicator Extraction Rules for an Incident Type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Create indicator extraction rules for incident types in Cortex XSOAR 6.14. - [Run Indicator Extraction in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/run-indicator-extraction-in-the-cli.md): Run indicator extraction and enrichment commands in the Cortex XSOAR 6.14 CLI. - [Create Indicator Extract Rules for a Playbook Task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/create-indicator-extract-rules-for-a-playbook-task.md): Create indicator extraction rules for playbook tasks in Cortex XSOAR 6.14. - [Disable Indicator Extraction for Automations or Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/disable-indicator-extraction-for-automations-or-integrations.md): Disable indicator extraction for automations or integrations in Cortex XSOAR 6.14. - [Indicator Expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-expiration.md): Cortex XSOAR 6.14 indicators have an active or expired status, which can be set to expire after a period of time or never to expire. Set default expiration method. - [Threat Intel Feeds](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/threat-intel-feeds.md): Import and export threat intelligence feeds in Cortex XSOAR 6.14. - [Feed Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/threat-intel-feeds/feed-integrations.md): Configure feed integrations that fetch indicators in Cortex XSOAR 6.14. - [Feed-Triggered Jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/threat-intel-feeds/feed-integrations/feed-triggered-jobs.md): Configure jobs triggered by threat intelligence feed updates in Cortex XSOAR 6.14. - [Set the Source Reliability of Enrichment Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/threat-intel-feeds/set-the-source-reliability-of-enrichment-integrations.md): Set enrichment integration source reliability in Cortex XSOAR 6.14. - [Threat Intelligence Management Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/threat-intel-feeds/threat-intelligence-management-playbooks.md): Configure threat intelligence management playbooks in Cortex XSOAR 6.14. - [Indicator Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management.md): Create, manage, search, and export indicators in Cortex XSOAR 6.14. - [Indicator Query](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/indicator-query.md): Search for and manage indicators in Cortex XSOAR 6.14. - [Configure the Indicator Timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/configure-the-indicator-timeline.md): Configure the indicator timeline and its performance in Cortex XSOAR 6.14. - [Exclusion List](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/exclusion-list.md): Add indicators to exclusion lists in Cortex XSOAR 6.14. - [Export Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/export-indicators.md): Export indicators as lists, files, and feeds from Cortex XSOAR 6.14. - [Manually Export Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/export-indicators/manually-export-indicators.md): Manually export indicators to files from Cortex XSOAR 6.14. - [Export Indicators Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/export-indicators/export-indicators-integrations.md): Export indicators with outbound-feed integrations in Cortex XSOAR 6.14. - [Export Indicators Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/export-indicators/export-indicators-playbooks.md): Use playbooks to process and export indicators in Cortex XSOAR 6.14. - [Export an Indicator to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/export-indicators/export-an-indicator-to-csv-using-the-utf8-bom-format.md): Export indicators to UTF-8 BOM CSV files in Cortex XSOAR 6.14. - [Indicator Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/indicator-relationships.md): Create and manage relationships between indicators in Cortex XSOAR 6.14. - [Create Indicator Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/indicator-relationships/create-indicator-relationships.md): Create indicator relationships that enhance investigations in Cortex XSOAR 6.14. - [Leverage Relationships in the Canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/indicator-relationships/leverage-relationships-in-the-canvas.md): Use Canvas indicator relationships to enrich investigations in Cortex XSOAR 6.14. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.