https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/indicator-extraction-refresh/m-p/1259833#M4263 <P>We're migrating from playbook task enrichment per incident to auto-extraction leveraging the TIM. One such example is a playbook&nbsp;&nbsp;</P> <P><STRONG>!extractIndicators text=${incident.sourceip} auto-extract=inline</STRONG></P> <P>Alternatively, I've also tried configuring the incident type to extract IP-recognized indicators automatically on <STRONG>Source IP</STRONG> field.</P> <P>Both options work fine if the indicator is brand new as the TIM IP record is created and populated with all the intel sources currently available with the !ip reputation command.</P> <P>But if the indicator already exists because it appeared in a prior incident, XSOAR doesn't refresh the intel sources. That's true even if the indicator is expired.</P> <P>What can I do to force re-enrichment of existing indicators when they resurface?</P> Thu, 23 Jul 2026 13:33:51 GMT KevinClerks 2026-07-23T13:33:51Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/indicator-extraction-refresh/m-p/1259833#M4263 <P>We're migrating from playbook task enrichment per incident to auto-extraction leveraging the TIM. One such example is a playbook&nbsp;&nbsp;</P> <P><STRONG>!extractIndicators text=${incident.sourceip} auto-extract=inline</STRONG></P> <P>Alternatively, I've also tried configuring the incident type to extract IP-recognized indicators automatically on <STRONG>Source IP</STRONG> field.</P> <P>Both options work fine if the indicator is brand new as the TIM IP record is created and populated with all the intel sources currently available with the !ip reputation command.</P> <P>But if the indicator already exists because it appeared in a prior incident, XSOAR doesn't refresh the intel sources. That's true even if the indicator is expired.</P> <P>What can I do to force re-enrichment of existing indicators when they resurface?</P> Thu, 23 Jul 2026 13:33:51 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/indicator-extraction-refresh/m-p/1259833#M4263 KevinClerks 2026-07-23T13:33:51Z