GetIndicatorsByQuery command

LIEWS05 — Fri, 12 Jan 2024 07:57:49 GMT

Hi all,

Does anyone knows how to retrieve the firstSeen/creation date of an indicator using the GetIndicatorsByQuery command?

These are the only fields I know that can be returned so far but none of them is the firstSeen/creationDate of the indicator.

id,value,lastSeen,investigationIDs

I'm unable to have it populate every fields as well to look through the available data..

Thanks..

Re: GetIndicatorsByQuery command

RahulVijaydev — Fri, 12 Jan 2024 18:49:30 GMT

Hello,

The output of GetIndicatorsByQuery is a file, so I'm not sure if that format is convenient. You can use SearchIndicators to retrieve additional fields into context for ex. !SearchIndicator query=`8.8.8.8` add_fields_to_context=firstSeen,lastSeen

Thanks,

Rahul Vijaydev

topic Re: GetIndicatorsByQuery command in Cortex XSOAR Discussions

GetIndicatorsByQuery command

Re: GetIndicatorsByQuery command