> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/indicator-query.md).
# Indicator Query
After you have customized indicators and started ingesting indicators into Cortex XSOAR, you can create indicators, add indicators, extract indicators, export indicators, etc. If you have a TIM license you can use Threat Intel Reports and use the Unit 42 feature.
The **Threat Intel** page displays a table or summary view of all indicators, and enables you to perform several indicator actions. If you do not have a TIM license, the page is called **Indicators**.
You can perform the following actions:
| Action | Description |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| View and take action on an indicator | Click on an indicator to view and take action on indicator. You can view in detail the verdict, relationships, timeline, enrich indicators, add tags, etc.
By default, when editing the following inline values in an incident/indicator, the changes are not saved until you confirm your changes (clicking the checkmark icon in the value field).
- Dropdown values, such as Owner, Severity, etc.
- Text values, such as Asset ID. (You can only edit when you click the pencil in the value field).
These icons are designed to let you have an additional level of security before you make changes to the fields in incidents/indicators.
To change this default behavior, set the inline.edit.on.blur server configuration to true to enable you to make changes to the inline fields without clicking the checkmark. The changes are automatically saved when clicking anywhere on the page or when navigating to another page. For text values you can also click anywhere in the value field to edit.
|
| Create a new indicator | Manually create a new indicator in the system. |
| Create an incident | Create an incident from the selected indicators and populate relevant incident fields with indicator data. |
| Edit | Edit a single indicator or select multiple indicators to perform a bulk edit. |
| Delete and Exclude | Delete and exclude one or more indicators from all indicator types or from a subset of indicator types.
If you select the Do not add to exclusion list checkbox, the selected indicators are only deleted.
|
| Export | Export the selected indicators to a CSV file. You can also [Export an Indicator to CSV Using the UTF8-BOM Format](/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/export-indicators/export-an-indicator-to-csv-using-the-utf8-bom-format.md). |
| Export (STIX) | Export the selected indicators to a STIX file. |
| Upload a STIX file | Upload a STIX file and add the indicators from the file to the system. |
#### Indicator Query
You can search for indicators using any of the available search fields. This is a partial list of the available search fields.
| Field | Description |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| **`type`** | The type of the indicator, such as File, Email, etc. |
| **`verdict`** | The reputation of the indicator:
- Malicious
- Suspicious
- Benign
- Unknown
|
| **`aggregatedReliability`** | Searches for indicators based on a reliability score such as **`A - Completely reliable`**. |
| **`sourceBrands`** | Indicator feed or enrichment integrations. |
| **`sourceInstances`** | A specific instance of an indicator feed or enrichment integration. |
| **`expirationSource`** | The source (script, manual, etc.) which last set the indicator's expiration status. |
| **`tags`** | Tags applied to indicators. |
| **`comments`** | Search for keywords within indicators’ comments. |
| **`isShared`** | (Multi-tenant) Whether the indicator is shared to tenant |
You can use a wildcard query, which finds indicators containing terms that match the specified wildcard. For example, the **`*`** pattern matches any sequence of 0 or more characters, and **`?`** matches any single character. For a regex query, use the following value:
**`"/.*\\?.*/"`**
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/indicator-query.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.