> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/indicators.md).

# Indicators

APIs for managing indicators

## Search indicators

> Search indicators by filter.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/indicators/search":{"post":{"tags":["Indicators"],"summary":"Search indicators","description":"Search indicators by filter.","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"operationId":"indicatorsSearch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IndicatorFilter"}}},"required":false},"responses":{"200":{"description":"indicatorResult","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IndicatorResult"}}}}}}}},"components":{"schemas":{"IndicatorFilter":{"title":"IndicatorFilter","type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 100.","format":"int64","default":100},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"DateRangeFilter":{"title":"DateRangeFilter","type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}},"description":"DateRangeFilter provides common fields for date filtering."},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"},"IndicatorResult":{"title":"IndicatorResult","type":"object","properties":{"accountErrors":{"type":"array","items":{"type":"string"}},"iocObjects":{"$ref":"#/components/schemas/IocObjects"},"total":{"type":"integer","format":"int64"},"totalAccounts":{"type":"integer","format":"int64"}}},"IocObjects":{"title":"IocObjects","type":"array","items":{"$ref":"#/components/schemas/IocObject"}},"IocObject":{"title":"IocObject","type":"object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"IocObject - represents an Ioc (or simply an indicator) object"},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Comments":{"title":"Comments","type":"array","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"title":"Comment","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"title":"CommentType","type":"string","description":"Comment types: regular comment, timeline, etc..."},"ExpirationSource":{"title":"ExpirationSource","type":"object","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"title":"ExpirationPolicy","type":"string"},"ExpirationSettingsSource":{"title":"ExpirationSettingsSource","type":"string"},"ExpirationStatus":{"title":"ExpirationStatus","type":"string"},"InsightCache":{"title":"InsightCache","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"InsightCache - map insight name to all its metadata. Name is case insensitive."},"DBotScore":{"title":"DBotScore","type":"object","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":"Contains the score of a specific brand for a specific insight."},"FeedIndicator":{"title":"FeedIndicator","type":"object","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}},"description":""},"FeedIndicatorComment":{"title":"FeedIndicatorComment","type":"object","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"Reliability":{"title":"Reliability","type":"string"}}}}
```

## Create an indicator exclusion list

> Create or update an indicator exclusion list.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/indicators/whitelist/update":{"post":{"tags":["Indicators"],"summary":"Create an indicator exclusion list","description":"Create or update an indicator exclusion list.","operationId":"post-xsoar-indicators-whitelist-update","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WhitelistedIndicator"}}},"required":false},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WhitelistedIndicator"}}}}}}}},"components":{"schemas":{"WhitelistedIndicator":{"type":"object","description":"WhitelistedIndicator Excluded indicator","properties":{"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"locked":{"type":"boolean"},"reason":{"type":"string"},"reputations":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"value":{"type":"string"},"whitelistTime":{"type":"string","format":"date-time"}}}}}}
```

## Create a relationship between indicators

> Create a relationship between indicators returned by specific search filters.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/relationship":{"post":{"summary":"Create a relationship between indicators","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"updatedRelationships":{"type":"integer"},"totalRelationships":{"type":"integer"}}}}}}},"operationId":"post-xsoar-relationship","description":"Create a relationship between indicators returned by specific search filters.","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"IDs":{"type":"array","items":{"type":"string"}},"All":{"type":"boolean"},"filter":{"type":"object","properties":{"page":{"type":"integer"},"size":{"type":"integer"},"query":{"type":"string"},"sort":{"type":"array","items":{"type":"object","properties":{"field":{"type":"string"},"asc":{"type":"boolean"}}}},"period":{"type":"object","properties":{"by":{"type":"string"},"fromValue":{"type":"integer"}}}}},"relationship":{"type":"object","properties":{"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"name":{"type":"string"},"reverseName":{"type":"string"},"fields":{"type":"object","properties":{"firstseenbysource":{"type":"string"},"lastseenbysource":{"type":"string"}}}}}}}}}},"tags":["Indicators"]}}}}
```

## Batch delete indicators or add them to the exclusion list

> Batch delete indicators or add them to the \[exclusion list]\(<https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.5/learn-about-cortex-xsoar/indicators/indicator-management/exclusion-list>).
> \
> To \*delete\* indicators, set \`doNotWhitelist\` field to \`true\`.
> \
> To add indicators to the exclusion list, set \`doNotWhitelist\` field to \`false\`.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/indicators/batchDelete":{"post":{"summary":"Batch delete indicators or add them to the exclusion list","tags":["Indicators"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateResponse"}}}}},"operationId":"post-indicators-batchDelete","description":"Batch delete indicators or add them to the [exclusion list](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.5/learn-about-cortex-xsoar/indicators/indicator-management/exclusion-list).\r\nTo *delete* indicators, set `doNotWhitelist` field to `true`.\r\nTo add indicators to the exclusion list, set `doNotWhitelist` field to `false`.","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/genericIndicatorUpdateBatch"}}}}}}},"components":{"schemas":{"UpdateResponse":{"type":"object","title":"UpdateResponse ...","properties":{"notUpdated":{"type":"integer","format":"int64"},"updatedIds":{"type":"array","items":{"type":"string"}},"uppdated":{"type":"integer","format":"int64"}}},"genericIndicatorUpdateBatch":{"type":"object","properties":{"all":{"type":"boolean","default":false,"description":"Warning: When updating or deleting indicator in a batch, setting this field to `true` will inverse your request and apply the action to all indicators *except* for the ones specified. If there are no indicators that match the filter settings or no indicators specified in the `ids` field, the action will be applied to all indicators. Setting this field to `false` will apply the action only on the indicators specified."},"columns":{"type":"array","items":{"type":"string"}},"doNotWhitelist":{"type":"boolean","description":"To delete a batch of indicators, set this to `true`."},"filter":{"$ref":"#/components/schemas/IndicatorFilter"},"ids":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"},"reputations":{"type":"array","items":{"type":"string"}}}},"IndicatorFilter":{"title":"IndicatorFilter","type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 100.","format":"int64","default":100},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"DateRangeFilter":{"title":"DateRangeFilter","type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}},"description":"DateRangeFilter provides common fields for date filtering."},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"}}}}
```

## Search for indicator relationships

> Search for a relationship between two indicators. You can search by indicator value, time, or retrieve all indicator relationships.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/relationships/search":{"post":{"summary":"Search for indicator relationships","tags":["Indicators"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"total":{"type":"integer"},"data":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"version":{"type":"integer"},"cacheVersn":{"type":"integer"},"sequenceNumber":{"type":"integer"},"primaryTerm":{"type":"integer"},"modified":{"type":"string"},"sizeInBytes":{"type":"integer"},"sortValues":{"type":"array","items":{"type":"string"}},"CustomFields":{"type":"object","properties":{"firstseenbysource":{"type":"string"},"lastseenbysource":{"type":"string"}}},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"name":{"type":"string"},"reverseName":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"type":{"type":"string"},"createdInSystem":{"type":"string"},"updatedInSystemBySource":{"type":"string"},"sources":{"type":"array","items":{"type":"object","properties":{"CustomFields":{"type":"object","properties":{"firstseenbysource":{"type":"string"},"lastseenbysource":{"type":"string"}}},"createdInSystem":{"type":"string"},"updatedInSystem":{"type":"string"},"instance":{"type":"string"},"isManual":{"type":"boolean"}}}}}}},"SearchAfter":{"type":"array","items":{"type":"string"}},"SearchBefore":{"type":"array","items":{"type":"string"}}}}}}}},"operationId":"post-xsoar-public-v1-relationships-search","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"description":"Search for a relationship between two indicators. You can search by indicator value, time, or retrieve all indicator relationships.","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"fromDate":{"type":"string"},"entities":{"type":"array","items":{"type":"string"}}}}}}}}}}}
```

## Create an indicator

> Create an indicator entity. &#x20;
> \\
>
> \
> To update indicator custom fields, they should be in lowercase with all spaces removed. For example: "Scan IP" -> "scanip".

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/indicator/create":{"post":{"summary":"Create an indicator","tags":["Indicators"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IocObject"}}}}},"operationId":"post-xsoar-public-v1-indicator-create","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"description":"Create an indicator entity.  \r\n\r\nTo update indicator custom fields, they should be in lowercase with all spaces removed. For example: \"Scan IP\" -> \"scanip\".","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IndicatorContext"}}}}}}},"components":{"schemas":{"IocObject":{"title":"IocObject","type":"object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"IocObject - represents an Ioc (or simply an indicator) object"},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Comments":{"title":"Comments","type":"array","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"title":"Comment","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"title":"CommentType","type":"string","description":"Comment types: regular comment, timeline, etc..."},"ExpirationSource":{"title":"ExpirationSource","type":"object","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"title":"ExpirationPolicy","type":"string"},"ExpirationSettingsSource":{"title":"ExpirationSettingsSource","type":"string"},"ExpirationStatus":{"title":"ExpirationStatus","type":"string"},"InsightCache":{"title":"InsightCache","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"InsightCache - map insight name to all its metadata. Name is case insensitive."},"DBotScore":{"title":"DBotScore","type":"object","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":"Contains the score of a specific brand for a specific insight."},"FeedIndicator":{"title":"FeedIndicator","type":"object","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}},"description":""},"FeedIndicatorComment":{"title":"FeedIndicatorComment","type":"object","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"Reliability":{"title":"Reliability","type":"string"},"IndicatorContext":{"type":"object","properties":{"entryId":{"type":"string"},"indicator":{"$ref":"#/components/schemas/IocObject"},"investigationId":{"type":"string"},"manually":{"type":"boolean"},"seenNow":{"type":"boolean"}},"title":""}}}}
```

## Batch export indicators to CSV

> Export a batch of indicators to a CSV file and receive the file ID in response. You can then use \[Get indicators as a CSV file]\(<https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/indicators#get-xsoar-public-v1-indicators-csv-filename>) to download the CSV file.
> \
> You can define the columns as well as filter the indicators to be included in the CSV file.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/indicators/batch/exportToCsv":{"post":{"summary":"Batch export indicators to CSV","tags":["Indicators"],"responses":{"200":{"description":"OK - returns the CSV filename.","content":{"application/json":{"schema":{"type":"string"}}}}},"operationId":"post-public_api-v1-indicators-batch-exportToCsv","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"description":"Export a batch of indicators to a CSV file and receive the file ID in response. You can then use [Get indicators as a CSV file](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/indicators#get-xsoar-public-v1-indicators-csv-filename) to download the CSV file.\r\nYou can define the columns as well as filter the indicators to be included in the CSV file.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/genericIndicatorUpdateBatch"}}},"description":"Required parameters are `columns` and `filter`. \r\nYou must include either `all` or `ids`.\r\n"}}}},"components":{"schemas":{"genericIndicatorUpdateBatch":{"type":"object","properties":{"all":{"type":"boolean","default":false,"description":"Warning: When updating or deleting indicator in a batch, setting this field to `true` will inverse your request and apply the action to all indicators *except* for the ones specified. If there are no indicators that match the filter settings or no indicators specified in the `ids` field, the action will be applied to all indicators. Setting this field to `false` will apply the action only on the indicators specified."},"columns":{"type":"array","items":{"type":"string"}},"doNotWhitelist":{"type":"boolean","description":"To delete a batch of indicators, set this to `true`."},"filter":{"$ref":"#/components/schemas/IndicatorFilter"},"ids":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"},"reputations":{"type":"array","items":{"type":"string"}}}},"IndicatorFilter":{"title":"IndicatorFilter","type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 100.","format":"int64","default":100},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"DateRangeFilter":{"title":"DateRangeFilter","type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}},"description":"DateRangeFilter provides common fields for date filtering."},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"}}}}
```

## Get a batch of indicators in a CSV file

> Download the indicator details in a CSV file format after preparing it by calling the \[Batch export indicators to CSV]\(<https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/indicators#post-xsoar-public-v1-indicators-batch-exporttocsv>) API endpoint. The response of that call contains the prepared indicator report filename with a timestamp. Use that filename as the path parameter in this API endpoint to download the file.
> \\
>
> \
> Note: To use cURL to run this command, add the \`-O\` curl command for downloading a file to the current folder, or \`-o /my\_custom\_location/my\_custom\_name.csv\` to customize the destination of the downloaded file.
> \
> For example:
> \
> \`\`\` curl
> \
> curl "<https://api-yourfqdn/xsoar/public/v1/indicators/csv/indicators\\_report\\_Mon\\_12\\_Aug\\_2024\\_10\\_06\\_04\\_UTC.csv"&#x20>;
> \
> -H 'content-type: application/json'&#x20;
> \
> -H 'accept: application/json'&#x20;
> \
> -H "Authorization:$api\_key"&#x20;
> \
> -H "x-xdr-auth-id:$api\_key\_id"&#x20;
> \
> -O&#x20;
> \
> \`\`\`

````json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/indicators/csv/{filename}":{"get":{"summary":"Get a batch of indicators in a CSV file","tags":["Indicators"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"file":{"type":"string","format":"binary","description":"Example content of the CSV file:\r\n\r\n\"id,value,verdict,expirationStatus\r\n9072e24d0da6620bf4ede78e5f990ddc,indicator_mZe0qZxl,Unknown,active\r\n7dacf1c7866f34ac1b84711a5ddfd33c,indicator_u75KsXBB,Unknown,active\r\n\""}}}}}}},"operationId":"ge-public-v1-indicators-csv-file","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"description":"Download the indicator details in a CSV file format after preparing it by calling the [Batch export indicators to CSV](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/indicators#post-xsoar-public-v1-indicators-batch-exporttocsv) API endpoint. The response of that call contains the prepared indicator report filename with a timestamp. Use that filename as the path parameter in this API endpoint to download the file.\r\n\r\nNote: To use cURL to run this command, add the `-O` curl command for downloading a file to the current folder, or `-o /my_custom_location/my_custom_name.csv` to customize the destination of the downloaded file.\r\nFor example:\r\n``` curl\r\ncurl \"https://api-yourfqdn/xsoar/public/v1/indicators/csv/indicators_report_Mon_12_Aug_2024_10_06_04_UTC.csv\" \r\n-H 'content-type: application/json' \r\n-H 'accept: application/json' \r\n-H \"Authorization:$api_key\" \r\n-H \"x-xdr-auth-id:$api_key_id\" \r\n-O \r\n```"}}}}
````

## Create feed indicators from JSON

> Create indicators from raw JSON (similar to ingesting from a feed). Builds indicators according to the specified feed classifier
> \
> or uses the default one if not specified.
> \\
>
> \
> The following indicator properties can be used in the JSON to create indicators:
> \\
>
> \
> See the \[Table for POST /xsoar/public/v1/indicators/feed/json]\(<https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/XSOAR-8-tables#table-for-post-xsoarpublicv1indicatorsfeedjson>) for more details.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/indicators/feed/json":{"post":{"summary":"Create feed indicators from JSON","tags":["Indicators"],"responses":{"201":{"description":"Indicators created","content":{"application/json":{"schema":{"type":"object","properties":{}}}}}},"operationId":"post-public_api-v1-indicators-feed-json","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"description":"Create indicators from raw JSON (similar to ingesting from a feed). Builds indicators according to the specified feed classifier\r\nor uses the default one if not specified.\r\n\r\nThe following indicator properties can be used in the JSON to create indicators:\r\n\r\nSee the [Table for POST /xsoar/public/v1/indicators/feed/json](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/XSOAR-8-tables#table-for-post-xsoarpublicv1indicatorsfeedjson) for more details.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FeedIndicatorsRequest"}}}}}}},"components":{"schemas":{"FeedIndicatorsRequest":{"description":"FeedIndicatorsRequest is the input for JSON feed indicator ingestion","type":"object","properties":{"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"indicators":{"type":"array","items":{"$ref":"#/components/schemas/RawFeedIndicator"}},"mapperId":{"type":"string"}}},"RawFeedIndicator":{"description":"RawFeedIndicator is an unparsed feed indicator from JSON ingestion","type":"object","additionalProperties":{"type":"object"}}}}}
```

## Edit indicator

> Edit an indicator.\
> \
> To update indicator custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Indicators","description":"APIs for managing indicators"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/indicator/edit":{"post":{"description":"Edit an indicator.\n\nTo update indicator custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip","summary":"Edit indicator","operationId":"post-public_api-v1-indicators-edit","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"OK","schema":{"$ref":"#/components/schemas/IocObject"},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IocObject"}}}}},"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IocObject"}}}},"tags":["Indicators"]}}},"components":{"schemas":{"IocObject":{"title":"IocObject","type":"object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"IocObject - represents an Ioc (or simply an indicator) object"},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Comments":{"title":"Comments","type":"array","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"title":"Comment","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"title":"CommentType","type":"string","description":"Comment types: regular comment, timeline, etc..."},"ExpirationSource":{"title":"ExpirationSource","type":"object","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"title":"ExpirationPolicy","type":"string"},"ExpirationSettingsSource":{"title":"ExpirationSettingsSource","type":"string"},"ExpirationStatus":{"title":"ExpirationStatus","type":"string"},"InsightCache":{"title":"InsightCache","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"InsightCache - map insight name to all its metadata. Name is case insensitive."},"DBotScore":{"title":"DBotScore","type":"object","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":"Contains the score of a specific brand for a specific insight."},"FeedIndicator":{"title":"FeedIndicator","type":"object","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}},"description":""},"FeedIndicatorComment":{"title":"FeedIndicatorComment","type":"object","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"Reliability":{"title":"Reliability","type":"string"}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/indicators.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.