How to append different IOC Indicator files in XSOAR

[cV V]

Uploading the IOC's File A and file B in playground-war room via CLI Command box attachment file upload option.

How to append the two IOC's File A and File B

[OKaraduman1 · Accepted solution]

Hi,

!extractIndicators command can extract the indicator which is given files. 

[jfernandes1 · Accepted solution]

Hi @cV V, since your trying to access data store inside a docx file you will need to first convert the file to plain text. 

You can use the !ParseWordDoc entryID= command first on the file in your screenshot. The output of this command will add a new file to context in .txt format.

You can then run the !extractIndicators entryID= command with this new file. The output of this command will create the ExtractedIndicators key in your context.

Please note that the ExtractedIndicators key will contain sub-keys for IP, URL, etc. Also, when you run this command multiple times, with 2 different files for example, the ExtractedIndicators with be converted into a list. To create a single list you can use the below command. 

!Set append=true value=${ExtractedIndicators.IP} key=ListofIPS 

[cV V]

Hi Jfernandes1

Thanks for the response & guide us on below process

1.Step

Uploading the IOC file in word document format below 2 files in xsoar CLI box attachment. (screenshots attached)

• testing.ioc fiel 
• File c

2. Extracted the Indicators with thier entry ID. (please find attached screenshot)

3. While appending the two files A and B step,  where we get those values for value= and key= not listed anywhere in !extractedindicators results (screenshot attached)

[jfernandes1]

Hi @cV V, in your example screenshot I see your using the ExtractIndicatorsFromWordFile automation, unfortunately this automation does not return any data to the context. The objective of the automation is to print the indicators from the docx file in the warroom, our auto-extraction feature will then process all those indicators. You can force the data to be pushed to the context by adding the extend-context option, example below. 

!ExtractIndicatorsFromWordFile entryID=${File.[0].EntryID} extend-context=file1data1=

Note: Do not add anything after the equal (=) symbol at the end.  

I would still suggest my earlier option of converting the files first since it provides more control. 

[cV V]

Hi all,

Appended two files eg: File A and File B by below command for CSV file formats.

Indicator values = ip  (ip's column in file A and file B)

tags =iocfileA,iocfileB (tags are added while uploading IOC files) 

!AppendindicatorFieldWrapper indicators_values="ip" tags="iocfileA,iocfileB"

Regards

kudos