Create custom lists for use in playbook comparisons
A custom list is a collection of values that you can use in a playbook, such as a list of banned countries, or blocked or allowed IP addresses. Custom lists are used to save information in a visual format that can be used to make decisions or track information about playbooks. In your Filter and Decision blocks, compare parameters against all the values in a custom list, rather than having to configure each comparison in the playbook.
See Example of using a custom list in a filter for an example of how to use a custom list in a playbook.
Create a custom list in
Perform the following steps to create a custom list in :
- From the Home menu, select Playbooks.
- Select the Custom Lists tab.
- Click + List to create a new list.
- Enter a name for the list.
- Enter or paste the list values in the table using one value per cell. For example, you can create a list of banned countries, or blocked or allowed IP addresses. Right-click in a cell to add or remove rows and columns.
- Click Save.
Import a custom list to using a CSV file
Perform the following tasks to import a CSV file to be used as a custom list. The file can't be larger than 1MB in size:
Use keyboard shortcuts in the classic playbook editor | View the list of configured playbooks in |
This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.0.1
Feedback submitted, thanks!