You specify an indicator query for the outbound-feed integration to determine which indicators are exported. You can send the resulting list or file to a SIEM or firewall to update policy rules.

The Export Indicators Service Integration fetches indicators based on the query that you define and exports them as a CSV file to a URL.

The PAN-OS EDL Service integration enables you to define an indicator query for the indicators you want to send from Cortex XSOAR to update an external dynamic list. An external dynamic list is a text file that is hosted on an external web server so that the firewall can import objects—IP addresses, URLs, domains—included in the list and enforce policy.