Indicator Extraction Refresh

KevinClerks — Thu, 23 Jul 2026 13:33:51 GMT

We're migrating from playbook task enrichment per incident to auto-extraction leveraging the TIM. One such example is a playbook

!extractIndicators text=${incident.sourceip} auto-extract=inline

Alternatively, I've also tried configuring the incident type to extract IP-recognized indicators automatically on Source IP field.

Both options work fine if the indicator is brand new as the TIM IP record is created and populated with all the intel sources currently available with the !ip reputation command.

But if the indicator already exists because it appeared in a prior incident, XSOAR doesn't refresh the intel sources. That's true even if the indicator is expired.

What can I do to force re-enrichment of existing indicators when they resurface?

Re: Indicator Extraction Refresh

jubilla — Mon, 27 Jul 2026 17:01:21 GMT

You can run the enrichIndicators command, it admits a list of indicators as well.

Example >> !enrichIndicators indicatorsValues=google.com

it will re-enrich the indicator with the enabled enrichment integrations, see the picture.

Best regards!

topic Re: Indicator Extraction Refresh in Cortex XSOAR Discussions

Indicator Extraction Refresh

Re: Indicator Extraction Refresh