Palo_Alto_Networks
XSIAM-ENGINEER · Question #24
Which action will prevent the automatic extraction of indicators such as IP addresses and URLs from a script's output?
The correct answer is C. Use 'AutoExtract': False in the script. To prevent Cortex XSIAM from automatically extracting indicators (like IPs, domains, and URLs) from a script's output, you must use 'AutoExtract': False in the script. This disables the auto- extraction mechanism for that script.
Automation and Orchestration
Question
Which action will prevent the automatic extraction of indicators such as IP addresses and URLs from a script's output?
Options
- AAdd 'ExtractIndicators': False to the script.
- BAdd 'IgnoreAutoExtract': True to the script.
- CUse 'AutoExtract': False in the script.
- DSet 'IndicatorExtraction': None in the script.
How the community answered
(37 responses)- B5% (2)
- C92% (34)
- D3% (1)
Explanation
To prevent Cortex XSIAM from automatically extracting indicators (like IPs, domains, and URLs) from a script's output, you must use 'AutoExtract': False in the script. This disables the auto- extraction mechanism for that script.
Topics
#indicator extraction#script configuration#auto-extract#XSIAM scripting
Community Discussion
No community discussion yet for this question.