Adding result of new custom Integration as Threat indicators results

[oDarweesh2]

Dears,

I made a custom Integration that get the verdict of (URLs) like (Malicious - Benign). Now I have a question How to add the name and result of this integration like the prebuilt Integrations which are in the screenshots (virus total - urlscan - etc..)..

kindly find the screenshot for claridication

[jfernandes1]

Hi @oDarweesh2, Your post did not contain a screenshot so I'm making an assumption that you were talking about reputation sources. When returning the indicator you need to specify the vendor. Example screenshots of code and output below.

[oDarweesh2]

Yes that what I am talking about.

But how to reflect it as you here put (indicator_value) in script. i replaced the values as you mentioned and when i ran it from command line. nothing changed.

Kindly find my code below in screenshot.

[jfernandes1]

Hi @oDarweesh2, The example that I provided cannot be run inside a warroom. Depending on the way your server is setup it may not work. Try the below method. For more information refer - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-9/cortex-xsoar-admin/manage-indicators/under....

The script I've attached below (Change extension from xml to yml) should be added as a Reputation Script inside the indicator type object. 

 - Go to Settings -> Object Setup -> Indicators -> Types

 - Select an Indicator type and click the Edit button. Screenshot below for reference.

Depending on your server setup you can then call indicator enrichment. Try !Print value=6.6.6.6 auto-extract=inline.