Export indicators with custom indicator fields

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Export indicators with custom indicator fields

L3 Networker

Our detection engineering team wants to upload a list of IOCs to XSOAR and get the VirusTotal scores of them as a csv file.

Through an automation I am extracting and enriching all the indicators and running


!ExportIndicatorsToCSV query="investigationIDs:47" columns="id,indicator_type,value,vtscore"


VT Score is a custom indicator field. It holds the VirusTotal score of the IOC but the data doesn't appear in the CSV file. I think that's because it is a custom field. It doesn't work with CustomField prefix "CustomField.vtscore" either.


How can export the indicators in an incident with custom fields?


L4 Transporter

It should work with custom fields as you described, for example I created a custom field, added it to IP indicators, and ran as below.

I'd put that field on the layout and make sure there is a value there.


!ExportIndicatorsToCSV query="beauchomperscore:12345" columns="id,indicator_type,value,beauchomperscore"









thank you for your help, I was giving the machine name of the indicator field as an argument but as it turns out only way to get the field is using its display name, in my case "VT Score" (case sensitive)




Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!