Extracting IOC from threat Intel Email

[athemmus423]

Hi everyone. I am new to this industry and I am looking for guidance on how to extract IOC from threat intel email body in Xsoar Playbook. Hoping if someone can help out. Thank you.

[cpayne26]

Hello.  

There are some training videos that can help you 

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-training-indicators/ta-...  Covers indicators
https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success... Since you're new here's the engineering training series have a look at part 11 but going through the whole series would be helpful since you're new.  The training series builds this usecas https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/use-cases/lc-xsoar-use-case-defini... 

[cpayne26]

One more thing that might be helpful is this upcoming webinar series  https://live.paloaltonetworks.com/t5/cortex-xsoar-events/customer-success-webinar-series-indicator-m...  These will provide a better understanding of indicator management.