> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/export-indicators.md).
# Export indicators
Export indicators and configure external dynamic lists in Cortex XSOAR 8.10 On-prem.
In the Indicators table, you can export indicators in a CSV or STIX file. You can also export indicators using an integration or a playbook.
Export indicators using the Generic Export Indicators Integration
You can export indicators in a hosted text file (External Dynamic list) from Cortex XSOAR or an engine using the Generic Export Indicators Service integration. Exported indicators can be used for example in firewall block lists, allow lists, and monitoring and analysis in Splunk. See [Generic Export Indicators Service](https://xsoar.pan.dev/docs/reference/integrations/edl).
The Generic Export Indicators Service integration can be configured to export specific fields in different output formats. Multiple instances of the integration can be configured for different indicator queries, and the output can be customized to work with a variety of third-party services.
You can set up the Generic Export Indicators Service integration by setting up a long-running integration. See [Forward requests to long-running integrations](/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/forward-requests-to-long-running-integrations.md).
If you configure the Generic Export Indicator to run on-demand, use the `!export-indicators-list-update` command for the first time to initialize the export process.
Export incidents and indicators to CSV using the UTF8-BOM format
By default, when exporting an incident or an indicator to CSV format, Cortex XSOAR generates the report in UTF8 format. If you need to export an incident or an indicator that contains Cyrillic characters such as Russian or Greek, you need to change the format to UTF8-BOM.
{% hint style="info" %}
### Note
When changing the format to UFT8-BOM you also change the format for incidents.
{% endhint %}
1. Select **Settings & Info** → **Settings** → **System** → **Server Settings** → **Add Server Configuration**.
2. Add the following key and value.
Key: `export.utf8bom`
Value: `true`
3. Save the server configuration.
Export indicators using playbooks
Cortex XSOAR provides numerous out-of-the-box playbooks for TIM, including playbooks that enable you to export indicators. All TIM-related playbooks have the 'TIM' prefix. Some are generic (for example, [TIM - Process Indicators - Fully Automated](https://xsoar.pan.dev/docs/reference/playbooks/tim---process-indicators---fully-automated)), and some are dedicated to a specific vendor, like QRadar (for example, [TIM - QRadar Add Domain Indicators](https://xsoar.pan.dev/docs/reference/playbooks/tim---q-radar-add-domain-indicators)) and ArcSight (for example, [TIM- Arcsight Add IP Indicators](https://xsoar.pan.dev/docs/reference/playbooks/tim---arc-sight-add-ip-indicators)).
{% hint style="info" %}
### Note
For TIM-related playbooks, you need a TIM license.
{% endhint %}
If you define a playbook task input that pulls from indicators, the entire playbook runs in Quiet Mode. This means the task or playbook information is not written to the War Room, and inputs and outputs are not displayed in the playbook. However, errors and warnings are still written to the War Room.
{% hint style="warning" %}
### Caution
You should not run a query on a field that you might change in the playbook flow. For example, you shouldn’t have a playbook with query **`Verdict:Malicious`** and then change the indicator verdict as a part of the playbook.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/export-indicators.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.