Lists

Lists can be created in the Cortex XSOAR UI and modified to be used in scripts and War Rooms. A list can contain items of the same type in any format that would be useful. These are later parsed by, and can be modified by, scripts. For example, you might need to create a list of emails, or a list of known trusted IPs (allow list), etc.

The Lists content item must be in JSON format and can be imported independently or as part of a pack.

Create a List#

Navigate to Settings > Advanced > Lists.
Click Add a List.
(Multi-tenant) From the dropdown list, select the propagation labels to propagate the list to the relevant tenants.
In the Content Type field, select the way the data is store under the data key in the json file.
To restrict access to the list, in the Permissions section, select the Read Only and Read and edit roles.
Click Save Version.
Exit the list editor.
Export the list by clicking .

Add Lists to your Project#

Save your newly created list to the Lists directory in your pack as a JSON file.
- The Lists directory is Packs/<pack_name>/Lists/.
- The name of the file should be list-<list_name>.json.
In the list json file that you created, edit the id field so that it is identical to the name field.
Modify the value in the version field to -1 to prevent user changes.
For example the top of your JSON file should look like this:

id: <name of your list>
version: -1
name: <name of your list>

Example of a Lists JSON File#

The following is an example of a list-checked_integrations.json file.

    {
        "allRead": false,
        "allReadWrite": false,
        "data": "Cylance Protect v2_instance_1,Core REST API_instance_1,Image OCR_default_instance,McAfee ESM v2_instance_1,Microsoft Defender Advanced Threat Protection_instance_2,Rasterize_default_instance,Trend Micro Deep Security_instance_1,Where is the egg?_default_instance,d2,fcm_default_instance,vt,ad-login,ad-query,splunk",
        "dbotCreatedBy": "",
        "description": "",
        "fromVersion": "6.5.0",
        "hasRole": false,
        "id": "checked integrations",
        "itemVersion": "",
        "locked": false,
        "name": "checked integrations",
        "nameLocked": false,
        "packID": "",
        "previousAllRead": false,
        "previousAllReadWrite": false,
        "previousRoles": [],
        "roles": [],
        "system": false,
        "tags": null,
        "toVersion": "",
        "truncated": false,
        "type": "plain_text",
        "version": -1
    }

Import a List#

You can import a content item list.

Navigate to Settings > Advanced > Lists.
Click .
Navigate to and select the content list to import.
Click Open.

For more information about lists, see the Cortex XSOAR Administrator's Guide.