topic Re: XSOAR Indicator Management webinar: Expired indicator and Bolt Database in Cortex XSOAR Discussions

XSOAR Indicator Management webinar: Expired indicator and Bolt Database

rtsedaka — Wed, 24 Jan 2024 21:34:21 GMT

**This question was asked during Part 1 of the webinar series: Indicator Management. You may review the recording here

If we are using Bolt database and an indicator is expired and has a last seen date of September 1, 2023 - does that mean it exists in the September Bolt database file? If we call the indicator command and the last seen date is updated, does this move the indicator to the latest Bolt db file? We want to use XSOAR marketplace integration for Generic Export Indicator service for EDLs but are concerned about potentially losing indicators with data retention efforts, accidental removal, etc. Losing indicators for an Allow list would be dangerous.

Re: XSOAR Indicator Management webinar: Expired indicator and Bolt Database

rtsedaka — Wed, 24 Jan 2024 21:35:39 GMT

A reply by @Aneesha More:

If we are using Bolt database and an indicator is expired and has a last seen date of September 1, 2023 - does that mean it exists in the September Bolt database file? If we call the indicator command and last seen date is updated does this move the indicator to latest Bolt db file? We want to use XSOAR marketplace integration for Generic Export Indicator service for EDLs but are concerned about potentially losing indicators with data retention efforts, accidental removal, etc. Losing indicators for an Allow list would be dangerous.