topic Export indicators with custom indicator fields in Cortex XSOAR Discussions

Export indicators with custom indicator fields

EnesOzdemir — Fri, 17 Feb 2023 06:39:20 GMT

Our detection engineering team wants to upload a list of IOCs to XSOAR and get the VirusTotal scores of them as a csv file.

Through an automation I am extracting and enriching all the indicators and running

!ExportIndicatorsToCSV query="investigationIDs:47" columns="id,indicator_type,value,vtscore"

VT Score is a custom indicator field. It holds the VirusTotal score of the IOC but the data doesn't appear in the CSV file. I think that's because it is a custom field. It doesn't work with CustomField prefix "CustomField.vtscore" either.

How can export the indicators in an incident with custom fields?

Re: Export indicators with custom indicator fields

MBeauchamp2 — Tue, 21 Feb 2023 17:00:39 GMT

It should work with custom fields as you described, for example I created a custom field, added it to IP indicators, and ran as below.

I'd put that field on the layout and make sure there is a value there.

!ExportIndicatorsToCSV query="beauchomperscore:12345" columns="id,indicator_type,value,beauchomperscore"

id	indicator_type	value	beauchomperscore
269442	IP	47.32.78.150	12345

Re: Export indicators with custom indicator fields

EnesOzdemir — Thu, 23 Feb 2023 14:07:58 GMT

thank you for your help, I was giving the machine name of the indicator field as an argument but as it turns out only way to get the field is using its display name, in my case "VT Score" (case sensitive)