This workflow validates the configuration of Cisco XDR intelligence feeds and their associated indicators. If the objects requested don't exist, they will be created. If they do exist, their IDs and URLs will be returned.

Targets: Private Intelligence API

Steps:
[] Search for indicators
[] Check if a matching indicator was found:
[]> If it was, extract the ID and set the output variable
[]> If it wasn't, create the indicator and set the output variable
[] Search for feeds
[] Check if a matching feed was found:
[]> If it was, extract the ID and view URL and set the output variables
[]> If it wasn't, create the feed and set the output variables

XDR - Validate or Create Intelligence Feed