> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field.md).

# Create an indicator field

Create indicator fields in Cortex XSOAR 8 SaaS.

Indicator fields are used to add specific indicator information to incidents. When you create an indicator field, you can associate the field to a specific indicator type or all indicator types. You can then map the custom field to the relevant indicator type. You can also add an indicator field trigger script.

{% hint style="info" %}
Cortex XSOAR IOC fields are based on the STIX 2.1 specifications. For more information, see [Indicator field structure](/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-fields-structure.md).
{% endhint %}

<details>

<summary>Field types</summary>

| Field type         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Boolean            | Checkbox                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Date picker        | Adds the date to the field.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Grid (table)       | <p>Include an interactive, editable grid as a field type for selected indicator types or all indicator types.</p><p>To see how to create a grid field and to use a script, see Create a grid field for an incident type.</p><p>When you select Grid (table) you can format the table and determine if the user can add rows.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| HTML               | <p>Create and view HTML content, which can be used in any type of indicator.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The following HTML tags are not permitted: <code>blockquote</code>, <code>del</code>, <code>dd</code>, <code>div</code>, <code>dl</code>, <code>dt</code>, <code>fieldset</code>, <code>form</code>, <code>h1</code>, <code>h2</code>, <code>h3</code>, <code>h4</code>, <code>h5</code>, <code>h6</code>, <code>hr</code>, <code>iframe</code>, <code>ins</code>, <code>li</code>, <code>math</code>, <code>noscript</code>, <code>ol</code>, <code>pre</code>, <code>p</code>, <code>script</code>, <code>style</code>, <code>table</code>, <code>ul</code>, <code>address</code>, <code>article</code>, <code>aside</code>, <code>canvas</code>, <code>details</code>, <code>dialog</code>, <code>figcaption</code>, <code>figure</code>, <code>footer</code>, <code>header</code>, <code>hgroup</code>, <code>main</code>, <code>nav</code>, <code>output</code>, <code>progress</code>, <code>section</code>, <code>video</code>.</p><p>The following CSS tags are not permitted: <code>background-color</code>, <code>text-align</code>, <code>font-size</code>, <code>font-family</code>, <code>font-weight</code>, <code>color</code>, <code>line-height</code>, <code>border-style</code>, <code>border</code>, <code>page-break-inside</code>, <code>tablelayout</code>, <code>padding</code>, <code>background-size</code>, <code>display</code>, <code>padding-top</code>, <code>padding-right</code>, <code>padding-bottom</code>, <code>padding-left</code>, <code>text-size-adjust</code>, <code>break-inside</code>, <code>word-break</code>, <code>width</code>, <code>height</code>, <code>-ms-text-size-adjust</code>, <code>-webkit-text-size-adjust</code>.</p></div> |
| Long text          | <ul><li>Long text is analyzed and tokenized, and entries are indexed as individual words, enabling you to perform advanced searches and use wildcards.</li><li>Long text fields can't be sorted and used in graphical dashboard widgets.</li><li>While editing a long text field, pressing Enter will create a new line (case is insensitive).</li></ul><p>Add a placeholder, if required.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Markdown           | Add markdown formatted text as a template, which will be displayed to users in the field after the indicator is created. Markdown lets you add basic formatting to text to provide a better end-user experience.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Multi select/Array | <p>Select the following options:</p><ul><li>Multi-select from a prefilled (static) list</li><li>An empty array field for the user to add one or more values as a comma-separated list</li></ul><p>Add a placeholder, if required.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Number             | Can contain any number. Default is 0.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Role               | The role assigned to the indicator. Determines which users (by role) can view the indicator.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Short text         | <ul><li>Short text is treated as a single unit of text and is not indexed by word. Advanced search, including wildcards, is not supported.</li><li>Short text fields are case-sensitive by default but can be changed to case-insensitive when creating the field.</li><li>While editing a short text field, pressing enter will save the change.</li><li>Maximum length 60,000 characters</li></ul><p>Recommended use is one-word entries, such as username and email address.</p><p>Select a placeholder, if required.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Single select      | Select a value from a list of options. Add comma-separated values.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Tags               | <p>Accepts a single tag or a comma-separated list, not case-sensitive.</p><p>Add a placeholder, if required.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| URL                | Add a URL when completing the field.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| User               | A user in Cortex XSOAR.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

</details>

<details>

<summary>How to create a field</summary>

1. Select **Settings & Info** → **Settings** → **Object Setup** → **Indicators** → **Fields** → **New Field**.
2. Select the relevant field type.
3. Complete the following fields (if relevant):

   | Parameter  | Description                                                                                                                                                                                                          |
   | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Mandatory  | If selected, this field is mandatory when used in a form.                                                                                                                                                            |
   | Field Name | A meaningful display name for the field. After you type a name, you will see below the field that the **Machine name** is automatically populated. The field’s machine name is applicable for searching and the CLI. |
   | Tooltip    | An optional tooltip for the field.                                                                                                                                                                                   |
4. In the Basic Settings tab, define the values (according to the selected field type).
5. On the Attributes tab, define the following:

   | Field                                  | Description                                                                                                                                                                                                                                                                                                                                               |
   | -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Script to run when field value changes | The script dynamically changes the field value when script conditions are met. For a script to be available, it must have the **`field-change-triggered-indicator`** tag when defining the script. For more information, see [Indicator field trigger scripts](https://docs-cortex.paloaltonetworks.com/r/4LaslOmHig2_utejqtsz0Q/~lV3H8Lx9hapddee5j0FhA). |
   | Add to all indicator types             | <p>This option is selected by default, which means this field is available to use in all indicator types.</p><p>Clear the checkbox to associate this field with a subset of indicator types.</p>                                                                                                                                                          |
   | Make data available for search         | The values for this field can be returned in searches.                                                                                                                                                                                                                                                                                                    |
6. Save the field.\
   If you subsequently edit the field, you can optionally select **Don't show in the indicators layout**. If you select this, the indicator field does not appear in the layout, but the data is displayed in the context data.
7. (Optional) Add a custom field to a section in the indicator layout.\
   If you select **Don't show in the indicators layout**, the field will not appear in the layout.
8. (Optional) In the indicator type, map custom indicator fields so an indicator field is automatically updated, without the analyst having to manually change it.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.