topic Re: Extracting IOC from threat Intel Email in Cortex XSOAR Discussions

Extracting IOC from threat Intel Email

athemmus423 — Thu, 04 Jan 2024 03:38:54 GMT

Hi everyone. I am new to this industry and I am looking for guidance on how to extract IOC from threat intel email body in Xsoar Playbook. Hoping if someone can help out. Thank you.

Re: Extracting IOC from threat Intel Email

cpayne26 — Thu, 04 Jan 2024 14:28:30 GMT

Hello.

There are some training videos that can help you

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-training-indicators/ta-p/559571 Covers indicators
https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success-engineering-training-video/ta-p/484604 Since you're new here's the engineering training series have a look at part 11 but going through the whole series would be helpful since you're new. The training series builds this usecas https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/use-cases/lc-xsoar-use-case-definition-xsoar-engineer-alerts.pdf

Re: Extracting IOC from threat Intel Email

cpayne26 — Thu, 04 Jan 2024 14:31:21 GMT

One more thing that might be helpful is this upcoming webinar series https://live.paloaltonetworks.com/t5/cortex-xsoar-events/customer-success-webinar-series-indicator-management-with-xsoar/ta-p/544357 These will provide a better understanding of indicator management.