Create a List - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Cortex XSIAM
Creation date
Last date published
Administrator Guide

Create predefined lists in Cortex XSIAM that can be parsed by and modified by scripts. Indicators exclusion list, internal IP ranges.

Lists can be created and modified to be used in scripts and War Rooms. A list can contain items of the same type in any format that would be useful. These are later parsed by, and can be modified by, scripts. For example, you might need to create a list of emails, a list of known trusted IPs (allow list), JSON objects, etc.

  1. Select SettingsConfigurationsObject SetupLists.

  2. Type the name of the list.

  3. From the dropdown list, select the Content Type.

  4. Add content as required, For an example of a JSON list and how to use it, see Work with JSON Lists.

  5. Save the list.