Araka, I recommend the "!GetIndicatoDBotScoreFromCache" automation because it is an "out of the box" automation and seems to meet your requirement of the overall reputation of an indicator. The other options you can pursue while support is investigating: If you disable the system URL indicator you can create a custom one with the same name (URL) with your new regular expression. If the name is URL, "!GetIndicatorDBotScore" should work. However, "!GetIndicatorDBotScore" pulls the individual enrichment reputation scores instead of overall score like "!GetIndicatoDBotScoreFromCache" does. You might have to migrate from one indicator type to another as well. You can detach/duplicate "!GetIndicatorDBotScore" and make an edit to it so that it will work with custom indicators. If you have a support case, please ask them to update the automation for all customers. Detach/duplicate is not a preferred method as content will not be updated by content pack (Common Scripts). I prefer to copy rather than detach because if the automation is accidentally reattached it will undo all changes. Hope that helps. Please let me know if you have any other questions.
... View more
