IOC Upload through API - Expiration date

[RFeyertag]

Hello dear community!

my ps script is ready to upload IOCs. One of my questions how fast the expiration date eraser is triggered in the dashboard? 

In the last case it took two days. 

This one is still active, but the expiration date is in the past. 

How can this be? 

BR

Rob

[afurze]

Hi RFeyertag,

IOC removal occurs as a daily job, you should see them removed within 24 hours of the expiration date and time.

[RFeyertag]

Hi @afurze: 

Thank you for your reply! You are right, but will there be a change to this? IOCs gets deleted, after Expiration Date + time entry?

Is it documented somewhere? 

Because here in this documentation you see a different answer:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/IOC-Rule-De...

BR

Rob

[afurze · Accepted solution]

RFeyertag,

The fact that this is done as a daily job is just an implementation detail.  It is unlikely that this will change.

[RFeyertag]

@afurze 

Thank you for this clarification. It would be nice, when your answer finds a place in the documentation. 

BR

Rob