Additional References

Insert Parsed IOCs Fields

Used by the Insert Parsed IOCs endpoint to describe the required and optional CSV fields for inserting indicators.

Field	Description
indicator	(Required) String that identifies the indicator you want to insert into Cortex XDR.
type	(Required) Keyword identifying the type of indicator. Valid values are: HASH, IP, PATH, DOMAIN_NAME, or FILENAME
severity	(Required) Keyword identifying the indicator's severity. Valid values are: INFO, LOW, MEDIUM, HIGH, or CRITICAL
expiration_date	Integer representing the indicator's expiration timestamp. This is a Unix epoch timestamp value, in milliseconds. If this indicator has no expiration, use Never. If this value is NULL, the indicator receives the indicator's type value with the default expiration date. Valid values are: 7 days, 30 days, 90 days, or 180 days
comment	Comment string.
reputation	Keyword representing the indicator's reputation. Valid values are: GOOD, BAD, SUSPICIOUS, or UNKNOWN
reliability	Character representing the indicator's reliability rating. Valid values are A-F. A is the most reliable, F is the least.
class	String representing the indicator class (for example, "Malware")
vendor.name	String representing the name of the vendor who reported this indicator.
vendor.reputation	Keyword representing the vendor's reputation. Valid values are: GOOD, BAD, SUSPICIOUS, or UNKNOWN
vendor.reliability	Character representing the vendor's reliability rating. Valid values are A-F. A is the most reliable, F is the least.