07-23-2026 06:33 AM
We're migrating from playbook task enrichment per incident to auto-extraction leveraging the TIM. One such example is a playbook
!extractIndicators text=${incident.sourceip} auto-extract=inline
Alternatively, I've also tried configuring the incident type to extract IP-recognized indicators automatically on Source IP field.
Both options work fine if the indicator is brand new as the TIM IP record is created and populated with all the intel sources currently available with the !ip reputation command.
But if the indicator already exists because it appeared in a prior incident, XSOAR doesn't refresh the intel sources. That's true even if the indicator is expired.
What can I do to force re-enrichment of existing indicators when they resurface?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
