Which action will prevent the automatic extraction of indicators such as IP addresses and URLs from a script's output?

In Palo Alto XSIAM (and Cortex XSOAR), automation scripts can return data to the War Room. By default, the platform parses this human-readable output to automatically find and extract indicators like IP addresses, URLs, and file hashes. To disable this behavior for a specific script output, the script must return an entry object that includes the key-value pair 'IgnoreAutoExtract': True. This flag explicitly instructs the system to bypass the automatic indicator extraction and enrichment process for that particular entry, preventing the indicators within the script's output from being added to the incident's context automatically.

A. 'ExtractIndicators': False is not a valid or recognized key within the XSIAM automation framework for controlling indicator extraction.
C. The key 'AutoExtract' is not the correct parameter; the platform specifically uses the 'IgnoreAutoExtract' key to manage this function.
D. The key 'IndicatorExtraction' and the value None are not the correct syntax used to disable this feature in script outputs.

1. Palo Alto Networks, Cortex XSOAR Developer Documentation. "Return Data to the War Room". In the section detailing how to return data, it explicitly states: "By default, Cortex XSOAR automatically extracts and enriches indicators from the human readable output. To prevent automatic extraction for an entry, add “IgnoreAutoExtract”: true to the entry." This is directly applicable to XSIAM automation. (Reference: Cortex XSOAR Developer Basics > Automations > Return Data to the War Room).