Delete Indicators Command

[MMagdic]

1) Is there a way to delete a batch of indicators with a single command, let's say all IP addresses imported with Feed XXX?

2) When I change Domain indicator expire time (Indicator Type) from 14 days to 1 hour, after expiration time indicators are still shown as active?!? Cortex XSOAR

[MBeauchamp2]

When writing an automation there is a builtin command called deleteIndicators that you can access, it takes a query to identify the indicators to delete.   

[MBeauchamp2]

I believe the expiration of indicators is actually controlled by a job that runs once per week, so it only gets updated on that frequency.  You can check the expiration date field if you need something faster. 

[MMagdic]

Found it, but how to use it in CLI?

[MBeauchamp2]

You don't, you write an automation that runs it. 😉

[MMagdic]

@MBeauchamp2 Thanks for the answer..
Cortex XSOAR why so complicating...Jesus!?

[MBeauchamp2 · Accepted solution]

Video 15 - Writing our first automation, walks through how to get started with writing them and using methods from the script helper if you need a reference as well! 

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success...

[MMagdic]

I've seen that playlist before and unfortunately that's the only way to learn something, e.g. Beacon is good only as introduction.