> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.9/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md). # Indicator lifecycle Indicators are text-based artifacts associated with incidents, such as IP addresses, URLs, and email addresses, and are an essential part of the incident management and remediation process. They help correlate incidents, create hunting operations, and enable you to easily analyze incidents and reduce Mean Time to Response (MTTR). The following diagram explains the indicator lifecycle in Cortex XSOAR. ![indictaor-lifecycle.png](/files/PaTrlKrs61IeHeK6fj94) | Step | Details | | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | 1. Identify the indicator type and value |

Cortex XSOAR analyzes the text-based artifact and if it matches the indicator type profile. The indicator value is extracted, based on the indicator profile definition. You can set up indicator extraction automatically in the incident type, or playbook. Indicator extraction identifies indicators from various sources within Cortex XSOAR, such as email headers, IP addresses, email addresses, and file hashes in file attachments. For more information about indicator extraction, see Indicator extraction.

You can create or customize existing indicator types, fields, and layouts for your use case. For more information, see Customize indicator types, fields, and layouts.

| | 2. Formatting and validation | Formatting and validation of the indicator are done using a formatting script that validates the data that represents the indicator's value and determines how we want the data to appear in Cortex XSOAR. For example, the URL indicator type uses the **FormatURL** script, which defangs URLs. For more information, see [Formatting scripts](/cortex-xsoar-8-on-prem/8.9/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts.md#formatting-scripts). | | 3. Create or update an indicator | If the indicator is not known to Cortex XSOAR, an indicator is created or you can create your own. If already known, it is updated with any new data including last seen dates. If the indicator is in an expired state but new data is received, it changes to active status. | | 4. Gather reputation and enrichment information |

You can run reputation commands and enhancement script commands on indicator values. You need to set them to run in the indicator type. The enhancement script also runs on the indicator type. Both determine the indicator's verdict. For more information, see Enhancement scripts.

When a reputation command/enhancement script is run, the verdict gets added to the incident context, when attached to an incident. Generally, the information is found under the Dbot Score key, the specific Indicator type, and specific vendor information.

Note

To run enhancement scripts and reputation commands, you must configure a relevant enrichment integration, such as VirusTotal, IPinfo v2, etc.

You can exclude reputation commands from specific integrations in the indicator type settings if, for example, you are limited with API credits, or the integration is unreliable.

| | 5. Reputation scripts | Reputation scripts can be used if you want to override existing reputation commands with custom logic. For those indicator types without reputation commands, a custom reputation script can be applied. Use it to customize verdicts and DBotScore context entry. For more information, see [Reputation scripts](/cortex-xsoar-8-on-prem/8.9/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts.md#reputation-scripts). | | 6. Map indicator fields | After your indicator is enriched, you can map fields. Some indicator fields are automatically mapped by Cortex XSOAR to contain the relevant values. The default settings can be changed for each indicator type. You can create and associate any custom fields with indicators. For more information, see [Indicator classification and mapping](/cortex-xsoar-8-on-prem/8.9/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md). | | 7. Expiration |

Many indicators have expiration dates as threats are dynamic. IP addresses may change, systems may be fixed, etc. When configuring an indicator type, you can set it never to expire or after a time interval. For more information, see Configure indicator expiration.

Tip

We recommend defining your policy for handling expired indicators.

| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.9/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.