An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields. How can this task be achieved?

Question

Robert Akehurst · Accepted Answer

In the Threat Intel page, add query firstSeen:>="90 days ago", select All columns in Table View, and click Export to export as a CSV.

Robert Akehurst · Answer

Run the command !GetIndicatorsByQuery in CLI with its default arguments and export all indicators in the last 90 days.

Robert Akehurst · Answer

SSH into the server and copy the indicator's database.

Robert Akehurst · Answer

Run the command !findIndicators in CLI with the query firstSeen:>="90 days ago" and export to CSV.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 114 - PCSAE discussion

Suggested answer: C

0 comments