Indicator Query

Search for and manage indicators in Cortex XSOAR 6.14.

You can search for indicators using any of the available search fields. This is a partial list of the available search fields.

Field	Description
type	The type of the indicator, such as File, Email, etc.
verdict	The reputation of the indicator: Malicious Suspicious Benign Unknown
aggregatedReliability	Searches for indicators based on a reliability score such as A - Completely reliable.
sourceBrands	Indicator feed or enrichment integrations.
sourceInstances	A specific instance of an indicator feed or enrichment integration.
expirationSource	The source (script, manual, etc.) which last set the indicator's expiration status.
tags	Tags applied to indicators.
comments	Search for keywords within indicators’ comments.
isShared	(Multi-tenant) Whether the indicator is shared to tenant

You can use a wildcard query, which finds indicators containing terms that match the specified wildcard. For example, the * pattern matches any sequence of 0 or more characters, and ? matches any single character. For a regex query, use the following value:

"/.*\\?.*/"