GetIndicatorsByQuery command

[LIEWS05]

Hi all,

Does anyone knows how to retrieve the firstSeen/creation date of an indicator using the GetIndicatorsByQuery command?

These are the only fields I know that can be returned so far but none of them is the firstSeen/creationDate of the indicator.

id,value,lastSeen,investigationIDs

I'm unable to have it populate every fields as well to look through the available data..

Thanks..

[RahulVijaydev]

Hello, 

The output of GetIndicatorsByQuery is a file, so I'm not sure if that format is convenient. You can use SearchIndicators to retrieve additional fields into context for ex. !SearchIndicator query=`8.8.8.8` add_fields_to_context=firstSeen,lastSeen

Thanks,

Rahul Vijaydev