Create a List - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
8
Creation date
2024-09-18
Last date published
2024-10-31
Category
Administrator Guide
Solution
Cloud
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation
Abstract

Create predefined lists in Cortex XSOAR that can be parsed by and modified by scripts. Indicators exclusion list, internal IP ranges.

Lists can be created and modified to be used in scripts and War Rooms. A list can contain items of the same type in any format that would be useful. These are later parsed by, and can be modified by, scripts. For example, you might need to create a list of emails, a list of known trusted IPs (allow list), JSON objects, etc.

  1. Select SettingsAdvancedListsAdd a List.

  2. Type the name of the list.

  3. From the dropdown list, select the Content Type.

  4. (Multi-tenant) From the dropdown list, select the propagation labels to propagate the list to the relevant child tenants.

  5. Add content as required. For an example of a JSON lost and how to use it, see Work with JSON Lists.

  6. To restrict access to the list, in the Permissions section, select the Read Only and Read and edit Roles.

  7. Save the list.