topic How to push Bulk IOC list in file format to Cortex XDR (IP address,Malicious URLS,Malicious Hashes ) via from XSOAR in Cortex XSOAR Discussions

How to push Bulk IOC list in file format to Cortex XDR (IP address,Malicious URLS,Malicious Hashes ) via from XSOAR

cV V — Tue, 02 Jul 2024 12:14:23 GMT

Hi Team,

I have integrated the Instance Cortex XDR - IOC content pack: Cortex XDR by Palo Alto Networks

kindly help me, below which command to push bulk update IOC indicators to Cortex XDR if am wrong kindly guide me.

Instance = Cortex XDR - IOC

Cortex XDR-IOC
xdr-iocs-create-sync-file	Creates the sync file for the manual process. Run this command when instructed by the XDR support team.
xdr-iocs-disable	Disables IOCs in the XDR server.
xdr-iocs-enable	Enables IOCs in the XDR server.
xdr-iocs-push	Push modified IOCs to Cortex XDR.
xdr-iocs-set-sync-time (Deprecated)	Set sync time manually. (Do not use this command unless you understand the consequences.)
xdr-iocs-sync	Sync your IOC with Cortex XDR and delete the old.
xdr-iocs-to-keep-file	Create a file with all the IOCs that are going to sync to Cortex XDR.

Re: How to push Bulk IOC list in file format to Cortex XDR (IP address,Malicious URLS,Malicious Hashes ) via from XSOAR

cV V — Thu, 04 Jul 2024 11:13:51 GMT

I run the below command for IOC push to XDR but show an error expiration time invalid and date cannot be in the past.

Kindly help me to resolve this error and need to push ioc's to XDR, error screenshot attached for your reference please help me.

Command:

!xdr-iocs-push indicator="1.179.247.182,45.141.148.220" using="Cortex XDR - IOC_instance_1"

The following IOCs were not pushed due to following errors: 1.179.247.182: Expiration time 1716529790609 is invalid; expiration date cannot be in the past. 45.141.148.220: Expiration time 1716529790609 is invalid; expiration date cannot be in the past.

Re: How to push Bulk IOC list in file format to Cortex XDR (IP address,Malicious URLS,Malicious Hashes ) via from XSOAR

cV V — Thu, 04 Jul 2024 09:31:29 GMT

Hi Team,

For bulk of IOC Lists i.e 100 no's IP's, Hashes, Domain names. how to push from XSOAR to XDR as a file or any form? does anyone worked this usecase scenario, kindly share!

For Single or Limit of 10 no's (IP , hashes, Domains Name ) the below command was working.

!xdr-iocs-enable indicator="172.15.1.50"

!xdr-iocs-push indicator="172.15.1.50"

!xdr-iocs-push indicator="fea456b3a78e87c2c99c5997b7255f553495a06a29bd7d4096cf72bfcbe1ed9b"

!xdr-iocs-enable indicator="vmtoolsd.exe"

Regards,

Chiranjeevi