topic Re: Delete Indicators Command in Cortex XSOAR Discussions

Delete Indicators Command

MMagdic — Wed, 12 Jul 2023 16:21:51 GMT

1) Is there a way to delete a batch of indicators with a single command, let's say all IP addresses imported with Feed XXX?

2) When I change Domain indicator expire time (Indicator Type) from 14 days to 1 hour, after expiration time indicators are still shown as active?!?

Re: Delete Indicators Command

MBeauchamp2 — Wed, 12 Jul 2023 17:06:23 GMT

When writing an automation there is a builtin command called deleteIndicators that you can access, it takes a query to identify the indicators to delete.

Re: Delete Indicators Command

MBeauchamp2 — Wed, 12 Jul 2023 17:07:32 GMT

I believe the expiration of indicators is actually controlled by a job that runs once per week, so it only gets updated on that frequency. You can check the expiration date field if you need something faster.

Re: Delete Indicators Command

MMagdic — Wed, 12 Jul 2023 17:11:34 GMT

Found it, but how to use it in CLI?

Re: Delete Indicators Command

MBeauchamp2 — Wed, 12 Jul 2023 17:14:12 GMT

You don't, you write an automation that runs it. 😉

Re: Delete Indicators Command

MMagdic — Wed, 12 Jul 2023 17:19:18 GMT

@MBeauchamp2 Thanks for the answer..
why so complicating...Jesus!?

Re: Delete Indicators Command

MBeauchamp2 — Wed, 12 Jul 2023 17:20:13 GMT

Video 15 - Writing our first automation, walks through how to get started with writing them and using methods from the script helper if you need a reference as well!

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success-engineering-training-video/ta-p/484604

Re: Delete Indicators Command

MMagdic — Wed, 12 Jul 2023 17:24:33 GMT

I've seen that playlist before and unfortunately that's the only way to learn something, e.g. Beacon is good only as introduction.