> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/indicators.md).

# Indicators

APIs for managing indicators

## Create Indicator

> Create an indicator entity\
> To update indicator custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"indicatorContext":{"type":"object","properties":{"entryId":{"type":"string"},"indicator":{"$ref":"#/components/schemas/IocObject"},"investigationId":{"type":"string"},"manually":{"type":"boolean"},"seenNow":{"type":"boolean"}}},"IocObject":{"type":"object","description":"IocObject - represents an Ioc (or simply an indicator) object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"created":{"type":"string","format":"date-time"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Comments":{"type":"array","title":"Comments ...","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"type":"object","title":"Comment ...","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"type":"string","title":"CommentType - comment type: regular comment, time-line, etc..."},"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."},"ExpirationStatus":{"type":"string","title":"ExpirationStatus ..."},"InsightCache":{"type":"object","description":"InsightCache - map insight name to all its metadata, name will be case insensitive","properties":{"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"DBotScore":{"type":"object","description":"DBotScore - Contain the score of a specific brand for a specific insight","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object"}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"FeedIndicator":{"type":"object","title":"FeedIndicator ...","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object"}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}}},"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"Reliability":{"type":"string","title":"Reliability ..."}}},"paths":{"/indicator/create":{"post":{"summary":"Create Indicator","description":"Create an indicator entity\nTo update indicator custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip","operationId":"indicatorsCreate","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/indicatorContext"}},"application/xml":{"schema":{"$ref":"#/components/schemas/indicatorContext"}}}},"responses":{"200":{"description":"IocObject","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IocObject"}}}}},"tags":["Indicators"]}}}}
```

## Edit Indicator

> Edit an indicator entity\
> To update indicator custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"IocObject":{"type":"object","description":"IocObject - represents an Ioc (or simply an indicator) object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"created":{"type":"string","format":"date-time"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Comments":{"type":"array","title":"Comments ...","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"type":"object","title":"Comment ...","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"type":"string","title":"CommentType - comment type: regular comment, time-line, etc..."},"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."},"ExpirationStatus":{"type":"string","title":"ExpirationStatus ..."},"InsightCache":{"type":"object","description":"InsightCache - map insight name to all its metadata, name will be case insensitive","properties":{"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"DBotScore":{"type":"object","description":"DBotScore - Contain the score of a specific brand for a specific insight","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object"}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"FeedIndicator":{"type":"object","title":"FeedIndicator ...","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object"}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}}},"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"Reliability":{"type":"string","title":"Reliability ..."}}},"paths":{"/indicator/edit":{"post":{"summary":"Edit Indicator","description":"Edit an indicator entity\nTo update indicator custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip","operationId":"indicatorsEdit","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IocObject"}},"application/xml":{"schema":{"$ref":"#/components/schemas/IocObject"}}}},"responses":{"200":{"description":"IocObject","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IocObject"}}}}},"tags":["Indicators"]}}}}
```

## Whitelists or deletes Indicator

> Whitelists or deletes an indicator entity\
> In order to delete an indicator and not whitelist, set doNotWhitelist boolean field to true

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"updateIndicatorReputationData":{"type":"object","properties":{"InvestigationId":{"type":"string"},"doNotWhitelist":{"type":"boolean"},"entryId":{"type":"string"},"manualScore":{"type":"boolean"},"reason":{"type":"string"},"reputation":{"type":"integer","format":"int64"},"reputations":{"type":"array","items":{"type":"string"}},"value":{"type":"string"}}},"UpdateResponse":{"type":"object","title":"UpdateResponse ...","properties":{"notUpdated":{"type":"integer","format":"int64"},"updatedIds":{"type":"array","items":{"type":"string"}},"uppdated":{"type":"integer","format":"int64"}}}}},"paths":{"/indicator/whitelist":{"post":{"summary":"Whitelists or deletes Indicator","description":"Whitelists or deletes an indicator entity\nIn order to delete an indicator and not whitelist, set doNotWhitelist boolean field to true","operationId":"indicatorWhitelist","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/updateIndicatorReputationData"}},"application/xml":{"schema":{"$ref":"#/components/schemas/updateIndicatorReputationData"}}}},"responses":{"200":{"description":"UpdateResponse","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateResponse"}}}}},"tags":["Indicators"]}}}}
```

## Batch export indicators to STIX

> Exports an indicators batch to STIX file (returns file ID)

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"requestBodies":{"genericIndicatorUpdateBatch":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/genericIndicatorUpdateBatch"}},"application/xml":{"schema":{"$ref":"#/components/schemas/genericIndicatorUpdateBatch"}}}}},"schemas":{"genericIndicatorUpdateBatch":{"type":"object","properties":{"all":{"type":"boolean"},"columns":{"type":"array","items":{"type":"string"}},"doNotWhitelist":{"type":"boolean"},"filter":{"$ref":"#/components/schemas/IndicatorFilter"},"ids":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"},"reputations":{"type":"array","items":{"type":"string"}}}},"IndicatorFilter":{"type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"earlyTimeInPage":{"type":"string","format":"date-time"},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"laterTimeInPage":{"type":"string","format":"date-time"},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"prevPage":{"type":"boolean","description":"MT support - these fields are for indicator search according to calculatedTime"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"DateRangeFilter":{"type":"object","description":"DateRangeFilter provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}}}},"paths":{"/indicators/batch/export/stix":{"post":{"summary":"Batch export indicators to STIX","description":"Exports an indicators batch to STIX file (returns file ID)","operationId":"exportIndicatorsToStixBatch","requestBody":{"$ref":"#/components/requestBodies/genericIndicatorUpdateBatch"},"responses":{"200":{"description":"STIX file name","content":{"application/json":{"schema":{"type":"string"}}}}},"tags":["Indicators"]}}}}
```

## Batch export indicators to csv

> Exports an indicators batch to CSV file (returns file ID)

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"genericIndicatorUpdateBatch":{"type":"object","properties":{"all":{"type":"boolean"},"columns":{"type":"array","items":{"type":"string"}},"doNotWhitelist":{"type":"boolean"},"filter":{"$ref":"#/components/schemas/IndicatorFilter"},"ids":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"},"reputations":{"type":"array","items":{"type":"string"}}}},"IndicatorFilter":{"type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"earlyTimeInPage":{"type":"string","format":"date-time"},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"laterTimeInPage":{"type":"string","format":"date-time"},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"prevPage":{"type":"boolean","description":"MT support - these fields are for indicator search according to calculatedTime"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"DateRangeFilter":{"type":"object","description":"DateRangeFilter provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}}}},"paths":{"/indicators/batch/exportToCsv":{"post":{"summary":"Batch export indicators to csv","description":"Exports an indicators batch to CSV file (returns file ID)","operationId":"exportIndicatorsToCsvBatch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/genericIndicatorUpdateBatch"}},"application/xml":{"schema":{"$ref":"#/components/schemas/genericIndicatorUpdateBatch"}}},"description":"Required parameters from `genericIndicatorUpdateBatch`: `columns`,\n`filter`. You should also include either `all` or `ids`\n"},"responses":{"200":{"description":"csv file name","content":{"application/json":{"schema":{"type":"string"}}}}},"tags":["Indicators"]}}}}
```

## Batch whitelist or delete indicators

> Batch whitelist or delete indicators entities\
> In order to delete indicators and not whitelist, set doNotWhitelist boolean field to true

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"requestBodies":{"genericIndicatorUpdateBatch":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/genericIndicatorUpdateBatch"}},"application/xml":{"schema":{"$ref":"#/components/schemas/genericIndicatorUpdateBatch"}}}}},"schemas":{"genericIndicatorUpdateBatch":{"type":"object","properties":{"all":{"type":"boolean"},"columns":{"type":"array","items":{"type":"string"}},"doNotWhitelist":{"type":"boolean"},"filter":{"$ref":"#/components/schemas/IndicatorFilter"},"ids":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"},"reputations":{"type":"array","items":{"type":"string"}}}},"IndicatorFilter":{"type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"earlyTimeInPage":{"type":"string","format":"date-time"},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"laterTimeInPage":{"type":"string","format":"date-time"},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"prevPage":{"type":"boolean","description":"MT support - these fields are for indicator search according to calculatedTime"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"DateRangeFilter":{"type":"object","description":"DateRangeFilter provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"UpdateResponse":{"type":"object","title":"UpdateResponse ...","properties":{"notUpdated":{"type":"integer","format":"int64"},"updatedIds":{"type":"array","items":{"type":"string"}},"uppdated":{"type":"integer","format":"int64"}}}}},"paths":{"/indicators/batchDelete":{"post":{"summary":"Batch whitelist or delete indicators","description":"Batch whitelist or delete indicators entities\nIn order to delete indicators and not whitelist, set doNotWhitelist boolean field to true","operationId":"deleteIndicatorsBatch","requestBody":{"$ref":"#/components/requestBodies/genericIndicatorUpdateBatch"},"responses":{"200":{"description":"UpdateResponse","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateResponse"}}}}},"tags":["Indicators"]}}}}
```

## Get indicators as CSV

> Get an indicators CSV file that was exported, by ID

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/indicators/csv/{id}":{"get":{"summary":"Get indicators as CSV","description":"Get an indicators CSV file that was exported, by ID","operationId":"getIndicatorsAsCsv","parameters":[{"name":"id","in":"path","description":"CSV file to fetch (returned from batch export to csv call)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Return Csv file"}},"tags":["Indicators"]}}}}
```

## Create feed indicators from JSON

> Create indicators from raw JSON (similar to ingesting from a feed). Builds indicators according to the specified feed classifier,\
> or uses the default one if not specified.\
> Indicator properties (all optional except for value): \*\*value\*\* (string, required) | \*\*type\*\* (string) | \*\*score\*\* (number, 0-3,\
> default \`0\`, where \`0\` means None, \`1\` Good, \`2\` Suspicious, and \`3\` Bad) | \*\*sourceBrand\*\* (string, default \`"External"\`) | \*\*sourceInstance\*\*\
> (string, default \`"External"\`) | \*\*reliability\*\* (string, one of \`"A - Completely reliable"\`, \`"B - Usually reliable"\`, \`"C - Fairly\
> reliable"\`, \`"D - Not usually reliable"\`, \`"E - Unreliable"\`, \`"F - Reliability cannot be judged"\`) | \*\*expirationPolicy\*\* (string,\
> one of \`"never"\`, \`"interval"\`, \`"indicatorType"\`) | \*\*expirationInterval\*\* (number, in minutes)

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"FeedIndicatorsRequest":{"type":"object","description":"FeedIndicatorsRequest is the input for JSON feed indicator ingestion","properties":{"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"indicators":{"type":"array","items":{"$ref":"#/components/schemas/RawFeedIndicator"}},"mapperId":{"type":"string"}}},"RawFeedIndicator":{"type":"object","description":"RawFeedIndicator is an unparsed feed indicator from JSON ingestion","additionalProperties":{"type":"object"}}}},"paths":{"/indicators/feed/json":{"post":{"summary":"Create feed indicators from JSON","description":"Create indicators from raw JSON (similar to ingesting from a feed). Builds indicators according to the specified feed classifier,\nor uses the default one if not specified.\nIndicator properties (all optional except for value): **value** (string, required) | **type** (string) | **score** (number, 0-3,\ndefault `0`, where `0` means None, `1` Good, `2` Suspicious, and `3` Bad) | **sourceBrand** (string, default `\"External\"`) | **sourceInstance**\n(string, default `\"External\"`) | **reliability** (string, one of `\"A - Completely reliable\"`, `\"B - Usually reliable\"`, `\"C - Fairly\nreliable\"`, `\"D - Not usually reliable\"`, `\"E - Unreliable\"`, `\"F - Reliability cannot be judged\"`) | **expirationPolicy** (string,\none of `\"never\"`, `\"interval\"`, `\"indicatorType\"`) | **expirationInterval** (number, in minutes)","operationId":"createFeedIndicatorsJson","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FeedIndicatorsRequest"}},"application/xml":{"schema":{"$ref":"#/components/schemas/FeedIndicatorsRequest"}}},"required":true},"responses":{"201":{"description":"Indicators created"}},"tags":["Indicators"]}}}}
```

## Search indicators

> Search indicators by filter

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"requestBodies":{"IndicatorFilter":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IndicatorFilter"}},"application/xml":{"schema":{"$ref":"#/components/schemas/IndicatorFilter"}}}}},"schemas":{"IndicatorFilter":{"type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"earlyTimeInPage":{"type":"string","format":"date-time"},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"laterTimeInPage":{"type":"string","format":"date-time"},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"prevPage":{"type":"boolean","description":"MT support - these fields are for indicator search according to calculatedTime"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"DateRangeFilter":{"type":"object","description":"DateRangeFilter provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"IndicatorResult":{"type":"object","title":"IndicatorResult ...","properties":{"accountErrors":{"type":"array","items":{"type":"string"}},"iocObjects":{"$ref":"#/components/schemas/IocObjects"},"total":{"type":"integer","format":"int64"},"totalAccounts":{"type":"integer","format":"int64"}}},"IocObjects":{"type":"array","title":"IocObjects ...","items":{"$ref":"#/components/schemas/IocObject"}},"IocObject":{"type":"object","description":"IocObject - represents an Ioc (or simply an indicator) object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"created":{"type":"string","format":"date-time"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Comments":{"type":"array","title":"Comments ...","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"type":"object","title":"Comment ...","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"type":"string","title":"CommentType - comment type: regular comment, time-line, etc..."},"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."},"ExpirationStatus":{"type":"string","title":"ExpirationStatus ..."},"InsightCache":{"type":"object","description":"InsightCache - map insight name to all its metadata, name will be case insensitive","properties":{"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"DBotScore":{"type":"object","description":"DBotScore - Contain the score of a specific brand for a specific insight","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object"}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"FeedIndicator":{"type":"object","title":"FeedIndicator ...","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object"}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}}},"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"Reliability":{"type":"string","title":"Reliability ..."}}},"paths":{"/indicators/search":{"post":{"summary":"Search indicators","description":"Search indicators by filter","operationId":"indicatorsSearch","requestBody":{"$ref":"#/components/requestBodies/IndicatorFilter"},"responses":{"200":{"description":"indicatorResult","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IndicatorResult"}}}}},"tags":["Indicators"]}}}}
```

## Get indicators as STIX V2

> Get an indicators STIX V2 file that was exported, by ID

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/indicators/stix/v2/{id}":{"get":{"summary":"Get indicators as STIX V2","description":"Get an indicators STIX V2 file that was exported, by ID","operationId":"getIndicatorsAsSTIX","parameters":[{"name":"id","in":"path","description":"STIX V2 file to fetch (returned from batch export to STIX call)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Return STIX V2 file"}},"tags":["Indicators"]}}}}
```

## Delete indicators timeline

> Delete indicators timeline by filter

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"requestBodies":{"IndicatorFilter":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IndicatorFilter"}},"application/xml":{"schema":{"$ref":"#/components/schemas/IndicatorFilter"}}}}},"schemas":{"IndicatorFilter":{"type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"earlyTimeInPage":{"type":"string","format":"date-time"},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"laterTimeInPage":{"type":"string","format":"date-time"},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"prevPage":{"type":"boolean","description":"MT support - these fields are for indicator search according to calculatedTime"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"DateRangeFilter":{"type":"object","description":"DateRangeFilter provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"IndicatorEditBulkResponse":{"type":"object","title":"IndicatorEditBulkResponse ...","properties":{"total":{"type":"integer","format":"uint64"},"updated":{"type":"integer","format":"uint64"}}}}},"paths":{"/indicators/timeline/delete":{"post":{"summary":"Delete indicators timeline","description":"Delete indicators timeline by filter","operationId":"indicatorsTimelineDelete","requestBody":{"$ref":"#/components/requestBodies/IndicatorFilter"},"responses":{"200":{"description":"IndicatorEditBulkResponse","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IndicatorEditBulkResponse"}}}}},"tags":["Indicators"]}}}}
```

## Create indicators

> Create indicators from a file

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"IocObjects":{"type":"array","title":"IocObjects ...","items":{"$ref":"#/components/schemas/IocObject"}},"IocObject":{"type":"object","description":"IocObject - represents an Ioc (or simply an indicator) object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"created":{"type":"string","format":"date-time"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Comments":{"type":"array","title":"Comments ...","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"type":"object","title":"Comment ...","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"type":"string","title":"CommentType - comment type: regular comment, time-line, etc..."},"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."},"ExpirationStatus":{"type":"string","title":"ExpirationStatus ..."},"InsightCache":{"type":"object","description":"InsightCache - map insight name to all its metadata, name will be case insensitive","properties":{"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"DBotScore":{"type":"object","description":"DBotScore - Contain the score of a specific brand for a specific insight","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object"}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"FeedIndicator":{"type":"object","title":"FeedIndicator ...","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object"}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}}},"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"Reliability":{"type":"string","title":"Reliability ..."}}},"paths":{"/indicators/upload":{"post":{"summary":"Create indicators","description":"Create indicators from a file","operationId":"indicatorsCreateBatch","requestBody":{"content":{"multipart/form-data":{"schema":{"type":"object","properties":{"fileName":{"description":"file name","type":"string"},"file":{"description":"file","type":"string"}}}}}},"responses":{"200":{"description":"IocObjects","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IocObjects"}}}}},"tags":["Indicators"]}}}}
```

## Create whitelisted

> Create or update excluded indicators list

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"WhitelistedIndicator":{"type":"object","description":"WhitelistedIndicator Excluded indicator","properties":{"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"reason":{"type":"string"},"reputations":{"type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"type":{"type":"string"},"user":{"type":"string"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"},"whitelistTime":{"type":"string","format":"date-time"}}}}},"paths":{"/indicators/whitelist/update":{"post":{"summary":"Create whitelisted","description":"Create or update excluded indicators list","operationId":"createOrUpdateWhitelisted","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WhitelistedIndicator"}},"application/xml":{"schema":{"$ref":"#/components/schemas/WhitelistedIndicator"}}},"required":true},"responses":{"200":{"description":"WhitelistedIndicator","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WhitelistedIndicator"}}}}},"tags":["Indicators"]}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/indicators.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.