Skip to main content


This Script is part of the Common Scripts Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.5.0 and later.

This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.

Script Data#

Script Typepython3


This script uses the following commands and scripts.

  • core-api-get
  • core-api-post


Argument NameDescription
queryThe query for the Indicators that you want to export. (e.g. type:IP and reputation:Bad and expirationStatus:active). You can and should generate the query from the Indicators search screen.
seenDaysIndicator last seen days (default is 7). Needs to be a number.
columnsComma separated list of columns (fields) for the CSV. (Default is: id,indicator_type,value,source,score,relatedIncCount,setBy,sourceBrands,modified)


There are no outputs for this script.