> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators.md).

# Export Indicators

**Manually Export Indicators**

You can select one or more indicators from the Indicators table and export them as a CSV file or STIX file. The file can then be sent to or pulled by a SIEM or firewall, or can be used as the input for a playbook that processes indicators.

1. Go to the **Threat Intel** (**Indicators**) page.
2. Select the checkbox for one or more indicators that you want to export to a file.
3. Export the selected indicators.

   * (Optional) Click the **Export** button to export the indicators to a CSV file.
   * (Optional) Click the **Export (STIX)** button to export the indicators to a STIX file.

   By default, the CSV file is generated in UTF8 format. You can change this to the [UTF8-BOM](/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/export-indicators/export-an-indicator-to-csv-using-the-utf8-bom-format.md) format.

**Export Indicators Integrations**

You can export indicators from Cortex XSOAR using the [Generic Export Indicators Service](https://xsoar.pan.dev/docs/reference/integrations/edl) integration. Exported indicators can be used for firewall block lists, allow lists, monitoring and analysis in Splunk, etc.

The [Generic Export Indicators Service](https://xsoar.pan.dev/docs/reference/integrations/edl) can be configured to export specific fields in different output formats. Multiple instances of the integration can be configured for different indicator queries, and the output can be customized to work with a variety of third party services.

**Export an Indicator to CSV Using the UTF8-BOM Format**

By default, when exporting an indicator to a CSV format, Cortex XSOAR generates the report in UTF8 format. If you want to export an indicator that contains Cyrillic characters, such as Russian, Greek, etc., you need to change the format to UTF8-BOM.

{% hint style="info" %}

### Note

This server configuration also changes the format for exported incidents to UTF8-BOM.
{% endhint %}

1. Select Settings → ABOUT → **Troubleshooting**.
2. In the **Server Configuration** section, click **Add Server Configuration**.
3. Add the following key and value.

   | Key                  | Value      |
   | -------------------- | ---------- |
   | **`Export.utf8bom`** | **`true`** |
4. Click **Save**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.