> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/create-indicator-extract-rules-for-a-playbook-task.md).

# Create Indicator Extract Rules for a Playbook Task

When using [indicator extraction](/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction.md) rules, indicators are extracted from tasks in playbooks.

The default indicator extraction value depends on the playbook task. For example, the indicator extraction mode is set to none in the **Enrich offending user account** task (from the Impossible Traveler playbook). In the **Extract the email address of the reporting user** task (from the Phishing Generic V3 playbook) indicator extract is set to system default.

{% hint style="info" %}

### Note

If you select system default in a task, the default is set to none. You can change the default by updating the **`reputation.calc.algorithm.tasks`** server configuration. For more information, see [Indicator Extraction Modes](/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/indicator-extraction-modes.md).
{% endhint %}

You can use the following commands in a task:

* **`extractIndicators`**
* Reputation commands, such as **`!ip`**, **`!domain`**, etc.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Reputation commands, such as <strong><code>!ip</code></strong> and <strong><code>!domain</code></strong>, can only be used after you configure and enable a reputation integration instance, such as Virus Total and Whois.</p></div>
* **`enrichIndicators`**

For more information, see [Run Indicator Extraction in the CLI](/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/run-indicator-extraction-in-the-cli.md).

1. If a content pack installed playbook, click either **Duplicate Playbook** or **Detach Playbook**.
2. Select the playbook you want to extract indicators, and click **Edit**.
3. In the playbook, click a task to extract indicators.
4. Click the **Advanced** tab.
5. In the indicator extraction dropdown menu, select the mode you want to use.
6. Click **OK**.

#### Extract Indicators from a Phishing Email

The following scenario shows how indicator extraction is used in the **Process Email - Generic** playbook to extract and enrich a very specific group of indicators.

This playbook parses the headers in the original email used in a phishing attack. It is important to parse the original email used in the phishing attack and not the email that was forwarded to ensure that you only extract the email headers from the malicious email and not the one your organization uses to report phishing attacks.

1. Go to the **Playbooks** page and search for the **Process Email - Generic v2** playbook.
2. Click either **Duplicate Playbook** or **Detach Playbook**.
3. If you have already duplicated or detached the playbook, click **Edit**.
4. Scroll down and open the **Add original email details to context** task.
5. In the **Automation** field, click **Set** and select **ParseEmailFilesV2**.

   In the **Outputs** tab you can see all of the different data that the task extracts, such as Email To, CC, From, etc.
6. Go to the **Advanced** tab.

   Under **Indicator Extraction mode**, ensure that the **`Inline`** option is selected. This indicates that all of the outputs are processed before the playbook moves ahead to the next task.
7. Open the **Display email information in layout** task. This task receives the data from the saved attachment tasks and sets the various data points to context.

   Under the **Advanced** tab, ensure that **Indicator Extraction mode** is set to **`None`**, as the indicators have already been extracted earlier in the **Extract email artifacts and attachments** task and there is no need to do it again.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/create-indicator-extract-rules-for-a-playbook-task.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.