> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/indicator-extraction-modes.md).

# Indicator extraction modes

Indicator extraction supports the following modes:

* **None**: Indicators are not extracted automatically. Use this option when you do not want to extract and enrich the indicators.
* **Inline**: Indicators are extracted within the context that the indicator extraction runs (synchronously). The findings are added to the context data. For example, if you define indicator extraction for the phishing incident type as inline:
  * For incident creation, by default, the playbook you defined to run does not run until the indicators have been extracted.
  * For an on field change, extraction occurs before the next playbook tasks run. Use this option when you need to have the most robust information available per indicator.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>This configuration may delay playbook execution. While indicator creation using the command createIndicator is asynchronous, automatic indicator extraction and enrichment is run synchronously. Data is placed into the incident context and is available via the context for subsequent tasks.</p></div>
* **Out of band**: Indicators are extracted in parallel (asynchronously) to other actions. The extracted data is available within the incident, but it is not available for immediate use in task inputs, or outputs, since the information is not available in real time.

  For incident creation, out of band is used in rare cases where you do not need the indicators extracted for the playbook flow. You still want to extract them and save them in the system as indicators, so that they can be reviewed at a later stage for manual review. System performance may be better as the playbook flow does not stop to extract, but if the incident contains indicators that are needed or expected in the playbook execution flow, inline should be used, as it will not execute the playbook before all indicators are extracted from the incident.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>When using Out of band, the extracted indicators do not appear in the context. If you want the extracted indicators to appear select Inline.</p></div>
* **Use system default**: Indicators are extracted according to the following defaults:

  | Component             | Description                                                                                                                                                                                 | Default     |
  | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
  | Incident creation     | Sets the indicator extraction mode for incident creation. It extracts from all associated fields at the point of incident creation. You can change the value when editing an incident type. | Inline      |
  | Incident field change | Sets the indicator extraction mode for incident field change. You can change the value when editing an incident type.                                                                       | Out of band |
  | Tasks                 | Applies to the result of the task. You can change the value when editing a task.                                                                                                            | None        |
  | Manual                | Applies to commands triggered from the CLI. You can change the value when using the indicator extraction parameter.                                                                         | Out of band |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/indicator-extraction-modes.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.