> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/add-indicators-to-siem-using-a-time-triggered-job.md). # Add Indicators to SIEM Using a Time Triggered Job In this example, after you have [processed indicators](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/process-indicators-using-a-job-triggered-by-delta.md) you can push relevant indicators to your SIEM by customizing the **TIM-Add All Indicator Types To SIEM** playbook. This playbook pushes the indicators (IP, bad hash, domains and URLs) that have been tagged to their respective lists in the SIEM. By default, the playbook is configured to work with ArcSight and QRadar, but you should change this to match the SIEM in your system. After configuration, run a time triggered job to run the playbook 1. Customize the **TIM - Add All Indicators Types to SIEM** playbook. 1. Go to **Playbooks** and search for **TIM - Add All Indicator Types to SIEM** and either detach or duplicate the playbook.

Note

If you detach the playbook, it does not receive content pack updates, until attached. If you want to receive content pack updates and keep your changes you should duplicate the playbook.

2. Click the **Playbook Triggered** task at the top of the playbook. 1. Select **From indicators** and set the query for the indicators to add. For example **`tags:approved_black, approved_white`**, etc. The purpose of the playbook is to send to SIEM only indicators that have been processed and tagged accordingly after an automatic or manual review process. The playbook comes out-of-the box with queries, but you can update it if required. 2. Save the playbook. 3. Make sure the playbook includes a task that closes the investigation once it completes. Save the playbook. 2. Define a Job to Push the Indicators to the SIEM. 1. Select **Jobs** → **New Job**. 2. Select **Time Triggered**. 3. (Optional) Select Recurring and determine how often you want the job to run. For example, run daily at midnight. 4. In the **Playbook** field, select the **TIM - Add All Indicator Types To SIEM** playbook to run. 5. Create **Create New Job**. Whenever an indicator is ingested that has a relevant tag such as **approved\_black**, the job pushes that indicator to the SIEM. 3. (Optional) Test the work flow. 1. Open the job that you created, when you [processed indicators](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/process-indicators-using-a-job-triggered-by-delta.md). You can tag any indicator with the tags that you want to push. It does not necessarily need to be this job. 2. In **Work Plan** open the **Create Process Indicators Manually incident** task. 3. In the **Outputs** tab, copy the incident ID for the incident that was created. 4. Go to **Incidents** and search for the incident ID that was created. 5. Review the indicators and add update the indicators with tags that you want to push to the SIEM, 6. When finished with the review, in the **Work Plan** , click the **Manually review the incident** task, select **Yes**, and **Mark Completed**. 7. Select the job you defined in step 2 and click **Run now**, 8. Go to **Indicators** and run the query **tags:SIEM**. This is the tag appended to every indicator that has been processed and pushed to the SIEM. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/add-indicators-to-siem-using-a-time-triggered-job.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.