> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/process-indicators-using-a-job-triggered-by-delta.md).

# Process Indicators Using a Job Triggered By Delta

In this example, you can set up a playbook to take indicators from a threat intel feed, enrich the indicators and determine which indicators should be investigated. In this example, we use the following:

* **Unit 42 Feed**: Fetches a list of indicators, provided by Palo Alto Network's Unit 42 threat researchers.
* The **TIM - Process Indicators - Manual Review** playbook: Tags indicators ingested by feeds that require manual approval. To enable the playbook, the indicator query needs to be configured. The playbook uses the **Indicator Auto Processing** sub-playbook. This playbook uses several sub playbooks to process and tag indicators, which is used to identify indicators that shouldn't be added to a blocked list, such as IP indicators that belong to business partners or important hashes.

  For the **TIM - Process Indicators - Manual Review** playbook to run, it needs to be triggered by a job. The job concludes by creating a new alert that includes all of the indicators that the analyst must review.

1. Configure the Unit 42 Feed.
   1. Go to **Settings** → **INTEGRATIONS** , search for **Unit 42 Feed** and click **Add instance**.
   2. Select **Fetches indicators**.
   3. Test the Feed to ensure that it is working correctly.
   4. Save and Exit.
2. Create a list of indicators not to process.

   Before customizing the playbook, it is recommended to create a list of indicators that you want to exclude from the manual review process. In this example, we will create a list of business partner IP addresses.

   1. Select **Settings** → **ADVANCED** → **Lists** → **Add a List**.
   2. Enter a meaningful name for the list. For example, BusinessPartnersIPaddresses.
   3. In the **Content Type** field, select **Text**.
   4. Select who can view or edit the list in the **PERMISSIONS** section.
   5. In the list enter a comma-separated list of IP addresses of your business partners.
   6. Save the list.
3. Customize the **TIM - Process Indicators - Manual Review** playbook.
   1. Go to **Playbooks** and search for **TIM-Process Indicators - Manual Review** and either detach or duplicate the playbook.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you detach the playbook, it does not receive content pack updates, until attached. If you want to receive content pack updates and keep your changes you should duplicate the playbook.</p></div>
   2. Click the **Playbook Triggered** task at the top of the playbook.
      1. Under **Inputs** in the **`OpenIncidentToReviewIndicatorsManually`** field, change the value to **`Yes`**, so an incident with the indicators for review is created.
      2. Select the **From indicators** radio button.
      3. Under Query, enter a query to process the specific indicators that you want. For example, **`sourceBrands:"Unit42Feed"`**.
      4. Save the playbook.
   3. Update the **TIM - Indicator Auto Processing** sub-playbook and either detach or duplicate the playbook.
      1. To exclude business partner IP addresses that you defined in step 2, locate and edit the **TIM - Process Indicators Against Business Partners IP List** task.
      2. From the **Inputs** tab, under **BusinessPartnersIPListName**, select the source and under **LISTS**, add the created list.
      3. Save the playbook.
   4. Make sure the playbook includes a task that closes the investigation once it completes. Save the playbook.
4. Define the job to run that will trigger the playbook when the indicators are fetched.

   1. Select **Jobs** → **New Job** → **Triggered by delta in feed**.
   2. From the **TRIGGERS** section, select Specific feeds and add the feed configured in step [1](#UUID-f9842777-9cef-172b-13aa-110674a21daf_N1669100098760).
   3. Enter a name for the job.
   4. In the Playbook field, add the playbook customized in step [3](#UUID-f9842777-9cef-172b-13aa-110674a21daf_N1669100133108).
   5. Create the new job.

   Whenever indicators are ingested from Unit 42, the playbook runs and creates an incident if an incident needs to be reviewed. You can track the status of the job in the Jobs table.
5. Test the job.
   1. In the Jobs page, find the new job and click **Running**.
   2. Go to **Workplan**.

      You can see the stage the Work Plan has reached and whether any indicators need to be investigated.
6. (Optional) You can [Add Indicators to SIEM Using a Time Triggered Job](/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/add-indicators-to-siem-using-a-time-triggered-job.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/process-indicators-using-a-job-triggered-by-delta.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.