For details, see:
Create custom lists for use in playbook comparisons
A custom list is a collection of values that you can use in a playbook, such as a list of banned countries, or blocked or allowed IP addresses. Custom lists are used to save information in a visual format that can be used to make decisions or track information about playbooks. In your Filter and Decision blocks, compare parameters against all the values in a custom list, rather than having to configure each comparison in the playbook.
See Example of using a custom list in a filter for an example of how to use a custom list in a playbook.
Create a custom list in
Custom lists have a size limit of 2GB.
Perform the following steps to create a custom list in :
- From the Home menu, select Playbooks.
- Select the Custom Lists tab.
- Click + List to create a new list.
- Enter a name for the list.
- Enter or paste the list values in the table using one value per cell. For example, you can create a list of banned countries, or blocked or allowed IP addresses. Right-click in a cell to add or remove rows and columns.
- Click Save.
Import a custom list to using a CSV file
Imported custom list files have a size limit of 1MB.
Perform the following tasks to import a CSV file to be used as a custom list.
Use keyboard shortcuts in the playbook editor | View the list of configured playbooks in |
This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.1.0, 5.2.1, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.4.0, 5.5.0, 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.1.1, 6.2.0, 6.2.1, 6.2.2, 6.3.0, 6.3.1, 6.4.0
Feedback submitted, thanks!