Skip to main content


This Script is part of the Common Scripts Pack.#

Gets a list of indicators from the indicators argument, and generates a JSON file in STIX 2.1 format.

Script Data#

Script Typepython3


Argument NameDescription
indicatorsA JSON object of all indicators and their fields, indicator index mapped to XSOAR common indicator fields. Indicator keys that don't match the XSOAR common indicator names are also supported, if their key contains a common indicator name (e.g. "special-ip" will be mapped to ip), or their value matches the expected indicator value (e.g. for ip).
doubleBackslashAdds a second backslash to all existing backslashes in the value field.


StixExportedIndicators.createdThe date/time that the indicator was
StixExportedIndicators.firstSeenThe date/time that the indicator was first
StixExportedIndicators.sourceThe source system for this indicator.string
StixExportedIndicators.typeThe STIX type (always exported as "indicator").string
StixExportedIndicators.patternThe type and value of indicators. For example, "URL", "IPv4", "domain", "email", and so on.string
StixExportedIndicators.scoreThe STIX impact score. Can be, "High", "Medium", "None", or "Not Specified".string
StixExportedIndicators.modifiedThe date/time that the indicator was last