Mapping fields to XSOAR IOCs

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Mapping fields to XSOAR IOCs

L0 Member

I'd appreicate guidance on how to update IOC fields with information extracted from an excuted playbook task. 


My use case centers around updating File Hash IOCs to include file signature metadata information to enable easier cleaning up of IOCs associated with known vendors such as Microsoft. 


Any assistance is appreciated. 


L4 Transporter

Hi @jemeche ,


You can make use of tags for that purpose. First, use appendIndicatorField automation to add a tag and then you can use that tag to filter tagged IOCs. I hope this answers your question.





L4 Transporter

You can also perform mapping to Indicator fields for enrichment data on the Indicator Type itself.  

Navigating to Settings -> Object Setup -> Indicators -> Types, and edit the Type you want. 

Select Custom Fields, and load the indicator, and you can map the values in the indicators context to fields, which will be set upon enrichment (or re-enrichment for the current indicator after you're done)


Screenshot 2023-08-02 at 7.55.15 AM.png

L0 Member


To update IOCs with file signature metadata, extract relevant information from the executed playbook task. Fetch existing IOCs from the database, match file hashes with extracted data, and update corresponding fields. Save the updated IOCs back to storage. Automate the process for regular updates. Prioritize security and access controls while handling sensitive information. Validate data accuracy regularly and test automation in a controlled environment before deployment. Use appropriate tools and scripting capabilities for implementation. Ensure compliance with security protocols and consider integrating with security automation platforms for efficiency.

Best regard,

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!