topic Re: IOC Upload through API - Expiration date in Cortex XDR Discussions

IOC Upload through API - Expiration date

RFeyertag — Sun, 30 Apr 2023 22:35:39 GMT

Hello dear community!

my ps script is ready to upload IOCs. One of my questions how fast the expiration date eraser is triggered in the dashboard?

In the last case it took two days.

This one is still active, but the expiration date is in the past.

How can this be?

Rob

afurze — Wed, 03 May 2023 14:26:13 GMT

Hi RFeyertag,

IOC removal occurs as a daily job, you should see them removed within 24 hours of the expiration date and time.

RFeyertag — Fri, 05 May 2023 22:02:03 GMT

Thank you for your reply! You are right, but will there be a change to this? IOCs gets deleted, after Expiration Date + time entry?

Is it documented somewhere?

Because here in this documentation you see a different answer:

Rob

afurze — Mon, 08 May 2023 14:04:03 GMT

RFeyertag,

The fact that this is done as a daily job is just an implementation detail. It is unlikely that this will change.

RFeyertag — Fri, 12 May 2023 08:11:37 GMT

Thank you for this clarification. It would be nice, when your answer finds a place in the documentation.

Rob