topic Re: Creating a Playbook to Upload Indicators to Various XDR Tenants in Cortex XSOAR Discussions

Creating a Playbook to Upload Indicators to Various XDR Tenants

michaelsysec242 — Thu, 24 Aug 2023 14:59:32 GMT

Hello all,

I am currently building a playbook that can pull indicators from an external MISP system and then publish them to various tenants of Cortex XDR. I have seen that there was a similar post in the past yet the solution suggested in 2022 does not appear to work as expected. In regards to available automation scripts I am using the task called XDR Push Indicators and I receive the following error.

Take note that I want to configure and push the indicators that I receive in a job and not from the threat intel indicators that are based on the XSOAR platform. For almost every XDR/EDR system there is a way to publish indicators. I don't see any task that allows me to push and indicator and choose what Severity or comment should be. What am I missing here ?

Thanks in advance.

Re: Creating a Playbook to Upload Indicators to Various XDR Tenants

gyldz — Fri, 25 Aug 2023 09:35:57 GMT

Hi @michaelsysec242 ,

I see that there are two commands run and one of them was successful. What is the difference between those two commands or do you have two different integration instances enabled which caused the command to run two times?

Re: Creating a Playbook to Upload Indicators to Various XDR Tenants

michaelsysec242 — Mon, 28 Aug 2023 10:53:18 GMT

Hello @gyldz ,

I am working with a few different Integrations including XDR IR, IOC and XQL. In the image I have sent I am only running it on a specific instance under the IOC integration. I cannot see any result of success from this method. Can you suggest a solution for this ?

If not ill head over to the support to escalate this.

Thanks

Re: Creating a Playbook to Upload Indicators to Various XDR Tenants

gyldz — Wed, 30 Aug 2023 06:54:52 GMT

Hi @michaelsysec242 ,

Unfortunately, I could not reproduce this in my environment. Could you please proceed with the support ticket?

Re: Creating a Playbook to Upload Indicators to Various XDR Tenants

cV V — Thu, 04 Jul 2024 10:08:23 GMT

Hello,

TRY on below order !

The following indicators were not found : 20.125.137.168

1. We need to enable the indicator

!xdr-iocs-enable indicator="20.125.137.168"

2. search the indicator whether its was listed

!SearchIndicator query="20.125.137.168"

3.Push the indicator

!xdr-iocs-push inidcator="20.125.137.168"

Regards,

Chiranjeevi