> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md). # Extract and enrich an indicator Indicator extraction identifies indicators from different text sources in the system (such as War Room entries), extracts them, and creates indicators in Cortex XSOAR. After extraction, the indicators are enriched. An administrator can set up indicator extraction automatically in an incident type or a playbook. For more information, see [Indicator Extraction](/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md). Indicator enrichment takes the extracted indicator and provides detailed information about the indicator (WHOIS information for example), using third-party integrations such as VirusTotal and IPinfo. If you want to extract an indicator manually, you can do the following: * Run indicator extraction in the CLI by running one of the following commands: | Command | Description | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | extractIndicators |

If you want to extract indicators from non-War-Room-entry sources (such as extracting from files), use the !extractIndicators command from the CLI. Use the command to do the following:

You can extract the following:

For example, type !extractIndicators text="some text 1.1.1.1 something" auto-extract=inline. The entry text contains the text of the indicators, which is extracted and enriched.

You can also extract indicators by adding the auto-extract parameter with the script and the mode for which you are setting it up. For example: !ReadFile entryId=826\@101 auto-extract=inline.

Usually, when using the CLI, you want to disable indicator extraction. For example, if you return internal/private data to the War Room, and you do not want it to be extracted and enriched in third-party services, add auto-extract=none to your CLI command.

| | enrichIndicators |

The enrichIndicators command is usually used when you want to batch enrich indicators. This command works on existing indicators only (it does not create them on its own). When running the command, the relevant enrichment command is triggered (such as !ip), which is based on the indicator type that is found. The data is saved to context and the indicator.

Note

Triggering enrichment on a substantial number of indicators can take time (because it's activating all enrichment integrations per indicator) and can result in performance degradation.

| | Reputation commands |

Reputation commands such as !ip, can be run for new indicators and indicators already in the system. If extraction is on, the data is saved both to the indicator and the incident's context. If not, then the data is saved only to the context because the mapping flow is always triggered in enrichment commands. The default configuration is set to none in playbook tasks for extraction.

Note

Reputation commands, such as !ip, !domain can only be used when you configure and enable a reputation integration instance, such as VirusTotal and WHOIS.

| * Use the **Enrich indicator** button in the indicator layout. This is the same effect as running a reputation command. You must have a TIM license to access the indicator layout. * Run indicator enrichment in the **Quick View** window If there is an enhancement script attached to the indicator type, in the indicator **Quick View** window, you can run a script to enrich an indicator. For example, the Domain indicator type uses the `DomainReputation` enhancement script. In an incident that contains a domain indicator type, click **Quick View**. In the Indicators tab, click **Domain** → **Actions** → **DomainReputation**. You can also run the enhancement script in the CLI. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.