Create predefined lists in Cortex XSOAR that can be parsed by and modified by scripts, including indicators, exclusion lists, and internal IP ranges.
Lists can be created and modified to be used in scripts and War Rooms. A list can contain items of the same type in any format that would be useful. These are later parsed by, and can be modified by, scripts. For example, you might need to create a list of emails, a list of known trusted IPs (allow list), JSON objects, etc.
Select
→ → → .Type the name of the list.
From the dropdown list, select the Content Type.
(Multi-tenant) From the dropdown list, select the propagation labels to propagate the list to the relevant tenants.
Add the content as required. For an example of a JSON list and how to use it, see Work with JSON Lists.
To restrict access to the list, in the Permissions section, select the Read Only and Read and edit roles.
Click Save.