This Script is part of the
Looks up incidents with a specified indicator. Uses
currentIncidentId to omit the existing incident from output.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
|indicator||The indicator to search for.|
|IncidentsWithIndicator.Indicator||The indicator that was found in other incidents.||Unknown|
|IncidentsWithIndicator.incidentIDs||The incident IDs that the indicator was found in.||Unknown|