Batch export indicators to STIX

Cortex XSOAR API

post /indicators/batch/export/stix Show code example
CURL
curl -X POST \ -H "Authorization: [[apiKey]]" \ -H "Accept: application/json" \ -H "Content-Type: application/json,application/xml" \ "https://hostname:443/indicators/batch/export/stix" \ -d '{ "all" : true, "filter" : { "ignoreWorkers" : true, "filterobjectquery" : "filterobjectquery", "fromDateLicense" : "2000-01-23T04:56:07.000+00:00", "searchAfterElastic" : [ "searchAfterElastic", "searchAfterElastic" ], "searchBefore" : [ "searchBefore", "searchBefore" ], "laterTimeInPage" : "2000-01-23T04:56:07.000+00:00", "period" : { "fromValue" : "fromValue", "toValue" : "toValue", "byFrom" : "byFrom", "field" : "field", "by" : "by", "byTo" : "byTo" }, "searchAfterMap" : { "key" : [ "searchAfterMap", "searchAfterMap" ] }, "searchAfterMapOrder" : { "key" : 1 }, "firstSeen" : { "fromDate" : "2000-01-23T04:56:07.000+00:00", "fromDateLicense" : "2000-01-23T04:56:07.000+00:00", "period" : { "fromValue" : "fromValue", "toValue" : "toValue", "byFrom" : "byFrom", "field" : "field", "by" : "by", "byTo" : "byTo" }, "toDate" : "2000-01-23T04:56:07.000+00:00", "timeFrame" : 0 }, "earlyTimeInPage" : "2000-01-23T04:56:07.000+00:00", "query" : "query", "searchBeforeElastic" : [ "searchBeforeElastic", "searchBeforeElastic" ], "toDate" : "2000-01-23T04:56:07.000+00:00", "trim_events" : 2, "prevPage" : true, "sort" : [ { "asc" : true, "field" : "field", "fieldType" : "fieldType" }, { "asc" : true, "field" : "field", "fieldType" : "fieldType" } ], "timeFrame" : 5, "fromDate" : "2000-01-23T04:56:07.000+00:00", "lastSeen" : { "fromDate" : "2000-01-23T04:56:07.000+00:00", "fromDateLicense" : "2000-01-23T04:56:07.000+00:00", "period" : { "fromValue" : "fromValue", "toValue" : "toValue", "byFrom" : "byFrom", "field" : "field", "by" : "by", "byTo" : "byTo" }, "toDate" : "2000-01-23T04:56:07.000+00:00", "timeFrame" : 0 }, "size" : 5, "searchAfter" : [ "searchAfter", "searchAfter" ], "accounts" : { "key" : "{}" }, "page" : 6, "fields" : [ "fields", "fields" ], "Cache" : { "key" : [ "Cache", "Cache" ] } }, "reason" : "reason", "reputations" : [ "reputations", "reputations" ], "columns" : [ "columns", "columns" ], "ids" : [ "ids", "ids" ], "doNotWhitelist" : true }' \ -d ' true aeiou true aeiou aeiou aeiou '
Exports an indicators batch to STIX file (returns file ID)