Create a List - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide
Product
Cortex XSIAM
Creation date
2024-02-26
Last date published
2024-04-25
Category
Administrator Guide
Abstract

Create predefined lists in Cortex XSIAM that can be parsed by and modified by scripts. Indicators exclusion list, internal IP ranges.

Lists can be created and modified to be used in scripts and War Rooms. A list can contain items of the same type in any format that would be useful. These are later parsed by, and can be modified by, scripts. For example, you might need to create a list of emails, a list of known trusted IPs (allow list), JSON objects, etc.

  1. Select Settings → Configurations → Object Setup → Lists.

  2. Type the name of the list.

  3. From the dropdown list, select the Content Type.

  4. Add content as required, For an example of a JSON list and how to use it, see Work with JSON Lists.

  5. Save the list.