Skip to main content

Xpanse Feed

This Integration is part of the Cortex Xpanse Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.10.0 and later.

Use this feed to retrieve the discovered IPs/Domains/Certificates from Cortex Xpanse asset database. This integration was integrated and tested with version 2.5 of Cortex Xpanse.

Configure Xpanse Feed on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for Xpanse Feed.

  3. Click Add instance to create and configure a new integration instance.

    Server URLThe web UI with `api-` appended to front (e.g.,\). For more information, see
    API Key IDFor more information, see Only standard API key type is supported.True
    API KeyTrue
    Fetch indicatorsFalse
    Indicator ReputationIndicators from this integration instance will be marked with this reputation.False
    Source ReliabilityReliability of the source providing the intelligence data.True
    Traffic Light Protocol ColorThe Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.False
    Bypass exclusion listWhen selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.False
    Use system proxy settingsFalse
    Trust any certificate (not secure)False
    TagsSupports CSV values.False
    Feed Fetch IntervalFalse
  4. Click Test to validate the URLs, token, and connection.


You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.


Retrieves a limited number of indicators.

Base Command#



Argument NameDescriptionRequired
limitThe maximum number of indicators to return.Required
ipRetrieve discovered IPs. Default is yes.Optional
domainRetrieve discovered domains. Default is yes.Optional
certificateRetrieve discovered certificates. Default is yes.Optional

Context Output#

ASM.Indicators.NameStringThe name of the indicator.
ASM.Indicators.DescriptionStringThe description of the indicator.
ASM.Indicators.TypeStringThe type of the indicator.

Command example#

!xpanse-get-indicators limit=1 ip=yes certificate=no domain=no

Context Example#

"ASM": {
"Indicators": {
"Description": " indicator of asset type IP from Cortex Xpanse",
"Name": "",
"Type": "IP"

Human Readable Output#

Xpanse indicators#

NameTypeDescription indicator of asset type IP from Cortex Xpanse