Set the indicator extraction mode for a playbook task - Create indicator extraction rules for a playbook task in Cortex XSIAM. Auto extract for a playbook task. Edit task. Use case indicator extraction. - Threat Intel Management Guide - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Select the playbook where you want to add indicator extraction to a task, and click Edit.

In the playbook, click a task to open the Edit Task window.

Click the Advanced tab.

In the indicator extraction drop-down menu, select the mode you want to use.

Click OK.