Creating a Playbook to Upload Indicators to Various XDR Tenants

[michaelsysec242]

Hello all, 

I am currently building a playbook that can pull indicators from an external MISP system and then publish them to various tenants of Cortex XDR. I have seen that there was a similar post in the past yet the solution suggested in 2022 does not appear to work as expected. In regards to available automation scripts I am using the task called XDR Push Indicators and I receive the following error. 

Take note that I want to configure and push the indicators that I receive in a job and not from the threat intel indicators that are based on the XSOAR platform. For almost every XDR/EDR system there is a way to publish indicators. I don't see any task that allows me to push and indicator and choose what Severity or comment should be. What am I missing here ? 

Thanks in advance.

Cortex XSOAR 

Cortex XDR 

[gyldz]

Hi @michaelsysec242 ,

I see that there are two commands run and one of them was successful. What is the difference between those two commands or do you have two different integration instances enabled which caused the command to run two times?

[michaelsysec242]

Hello @gyldz ,

I am working with a few different Integrations including XDR IR, IOC and XQL. In the image I have sent I am only running it on a specific instance under the IOC integration. I cannot see any result of success from this method. Can you suggest a solution for this ?

If not ill head over to the support to escalate this. 

Thanks 

[gyldz]

Hi @michaelsysec242 ,

Unfortunately, I could not reproduce this in my environment. Could you please proceed with the support ticket?

[cV V]

Hello,

TRY on below order !

The following indicators were not found : 20.125.137.168 

1. We need to enable the indicator

!xdr-iocs-enable indicator="20.125.137.168"

2. search the indicator whether its was listed

!SearchIndicator query="20.125.137.168"

3.Push the indicator

!xdr-iocs-push inidcator="20.125.137.168"

Regards,

Chiranjeevi