Export indicators with custom indicator fields

[EnesOzdemir]

Our detection engineering team wants to upload a list of IOCs to XSOAR and get the VirusTotal scores of them as a csv file.

Through an automation I am extracting and enriching all the indicators and running

!ExportIndicatorsToCSV query="investigationIDs:47" columns="id,indicator_type,value,vtscore"

VT Score is a custom indicator field. It holds the VirusTotal score of the IOC but the data doesn't appear in the CSV file. I think that's because it is a custom field. It doesn't work with CustomField prefix "CustomField.vtscore" either.

How can export the indicators in an incident with custom fields?

[MBeauchamp2]

It should work with custom fields as you described, for example I created a custom field, added it to IP indicators, and ran as below.

I'd put that field on the layout and make sure there is a value there.

!ExportIndicatorsToCSV query="beauchomperscore:12345" columns="id,indicator_type,value,beauchomperscore"

id	indicator_type	value	beauchomperscore
269442	IP	47.32.78.150	12345

[EnesOzdemir]

thank you for your help, I was giving the machine name of the indicator field as an argument but as it turns out only way to get the field is using its display name, in my case "VT Score" (case sensitive)