topic Re: How to append different IOC Indicator files in XSOAR in Cortex XSOAR Discussions

How to append different IOC Indicator files in XSOAR

cV V — Wed, 22 May 2024 12:23:06 GMT

Uploading the IOC's File A and file B in playground-war room via CLI Command box attachment file upload option.

How to append the two IOC's File A and File B

Re: How to append different IOC Indicator files in XSOAR

OKaraduman1 — Thu, 23 May 2024 07:21:57 GMT

Hi,

!extractIndicators command can extract the indicator which is given files.

Re: How to append different IOC Indicator files in XSOAR

jfernandes1 — Fri, 24 May 2024 00:50:45 GMT

Hi @cV V, since your trying to access data store inside a docx file you will need to first convert the file to plain text.

You can use the !ParseWordDoc entryID= command first on the file in your screenshot. The output of this command will add a new file to context in .txt format.

You can then run the !extractIndicators entryID= command with this new file. The output of this command will create the ExtractedIndicators key in your context.

Please note that the ExtractedIndicators key will contain sub-keys for IP, URL, etc. Also, when you run this command multiple times, with 2 different files for example, the ExtractedIndicators with be converted into a list. To create a single list you can use the below command.

!Set append=true value=${ExtractedIndicators.IP} key=ListofIPS

Re: How to append different IOC Indicator files in XSOAR

cV V — Mon, 27 May 2024 05:56:11 GMT

Hi Jfernandes1

Thanks for the response & guide us on below process

1.Step

Uploading the IOC file in word document format below 2 files in xsoar CLI box attachment. (screenshots attached)

testing.ioc fiel
File c

2. Extracted the Indicators with thier entry ID. (please find attached screenshot)

3. While appending the two files A and B step, where we get those values for value= and key= not listed anywhere in !extractedindicators results (screenshot attached)

Re: How to append different IOC Indicator files in XSOAR

jfernandes1 — Mon, 27 May 2024 08:54:28 GMT

Hi @cV V, in your example screenshot I see your using the ExtractIndicatorsFromWordFile automation, unfortunately this automation does not return any data to the context. The objective of the automation is to print the indicators from the docx file in the warroom, our auto-extraction feature will then process all those indicators. You can force the data to be pushed to the context by adding the extend-context option, example below.

!ExtractIndicatorsFromWordFile entryID=${File.[0].EntryID} extend-context=file1data1=

Note: Do not add anything after the equal (=) symbol at the end.

I would still suggest my earlier option of converting the files first since it provides more control.

Re: How to append different IOC Indicator files in XSOAR

cV V — Mon, 27 May 2024 11:07:44 GMT

Hi all,

Appended two files eg: File A and File B by below command for CSV file formats.

Indicator values = ip (ip's column in file A and file B)

tags =iocfileA,iocfileB (tags are added while uploading IOC files)

!AppendindicatorFieldWrapper indicators_values="ip" tags="iocfileA,iocfileB"

Regards

kudos

Re: How to append different IOC Indicator files in XSOAR

cV V — Thu, 04 Jul 2024 08:56:04 GMT

Hi Team,

Thanks for the response !

Solution

To Append two IOC indicator file A and B

Steps:

1.Upload the IOC file in "A" and " B" while uploading add the tags "fileA" and "fileB"

2.Command for Append

!AppendindicatorFieldWrapper indicators_values="ip" tags="fileA,fileB"

3.View the appended IOC list in full table in a new tab and or download / export in CSV

Regards,

Chiranjeevi