> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md).
# Indicator extraction
Indicator extraction identifies indicators from different text sources in the system (such as War Room entries, email content, etc.), extracts them (usually based on regex) and creates indicators in Cortex XSOAR. After extraction, the indicator can be enriched.
After indicators are extracted, they are enriched using commands and scripts defined for the indicator type. Indicator enrichment provides detailed information about the indicator, based on enrichment feeds such as VirusTotal and IPinfo.
To extract indicators from incoming feeds without enrichment or to prevent enrichment for existing indicators, see [Exclude indicators from enrichment](/cortex-xsoar-8-on-prem/8.8/detect-and-respond-to-threats/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md).
{% hint style="info" %}
### Note
Reputation commands, such as **`!ip`** and **`!domain`**, can only be used after you configure and enable a reputation integration instance, such as Virus Total and Whois.
{% endhint %}
Some content packs include a dashboard and widget that track API rate limit errors. You can use this information for troubleshooting and to make decisions about indicator enrichment.
### Indicator extraction methods
You can customize indicator extraction using the following methods:
* Incident types
You can extract indicators from incident fields when an incident is created and when an incident field changes. Indicator extraction rules for content pack incident types are determined by the content pack. For example, in a Phishing incident type, by default, in the Destination IP field, IPv6 and IP indicators are extracted. For the Detection URL field, the URL indicator field is extracted.
If enabled, indicator extraction is automatic. For example, in a Phishing incident, indicator extraction is set to extract the IP indicator (in the incident type). When the incident field updates, the IP indicator field is extracted automatically. In the War Room, you can check that the IP indicator field has been extracted by typing **`1.1.1.1`**. Cortex XSOAR recognizes the indicator as an IP indicator by matching it to the IP indicator’s regex. It then extracts and enriches the indicator using an integration that includes the IP command (such as IPinfo).
Note
To change the indicator extraction rules for an incident type installed with a content pack, including an incident type propagated to a tenant in a multi-tenant environment, you need to detach the incident type. Once detached, the incident type does not receive new content from Cortex XSOAR. If you want to receive content updates reattach the incident type. If you want to instead receive content updates and save the content, duplicate the incident type and edit the duplicate type. For more information, see Incident layout customization.
Caution
Extracting indicators can adversely affect system performance. We recommend that you define extraction settings for each incident type, as needed.
For example, for Malware you may want to extract all IP addresses, for Phishing you may only want to extract IP addresses from specific email headers. For attachments, you may want to disable indicator extraction to reduce external API usage and protect restricted data (the hash) from being sent.
Note
This configuration may delay playbook execution. While indicator creation using the command createIndicator is asynchronous, automatic indicator extraction and enrichment is run synchronously. Data is placed into the incident context and is available via the context for subsequent tasks.
Note
When using Out of band, the extracted indicators do not appear in the context. If you want the extracted indicators to appear select Inline.
Some indicator types are associated with a regex (such as IP), and some are not (such as Registry Key).
Only indicators that are associated with a regex are extracted.
|
| **Specific indicator types** | You can choose one or more indicator types based on regex. The system extracts values that match the regex from this incident field. |
Select the **Use field value** checkbox, to use any indicator based on the field value (not regex based). This creates an indicator out of the entire value of the field, regardless whether the indicator type has a configured regex. This can be used in cases such as extracting hostnames.
Note
- We recommend turning off (setting to None) incident extraction for the Labels incident field. When an incident JSON is received from an integration, the JSON members are mapped to incident fields (based on the mapping configuration). Every member in the JSON that was not mapped to a field, will be written to the Labels field. If the Labels field extracts indicators, it can expose unmapped or unknown data to external sources. You should only map the relevant data to fields and set their extraction settings.
- If you want to extract attachments, select the attachment field and then select File as the indicator type to extract. The File extracts a hash (usually SHA-256), which can be viewed in the War Room. You may want to disable indicator extraction for attachments to reduce external API usage and protect restricted data (the hash) from being sent.