End-of-Life (EoL)

Work With Lists

A list is a collection of one or more items of the same type, for example plain text, JSON, or HTML, that you can use in scripts, playbooks, or any other place where the context button appears (double-curly brackets).

Use cases

These are some common use cases for creating and using lists in Cortex XSOAR.
  • A list of allowed executable files against which to check potentially malicious executable files.
  • An HTML template that you can define to use as part of a Communication task.
  • Store data object, for example JSON, that you can call as inputs for scripts and playbooks.
  • Use the
    getList
    or
    addToList
    commands in a script to take action based on the list data, for example,
    res = demisto.executeCommand("getList", {"listName": demisto.args()["listName"]})
    will return all list entries in the script.

List commands

You can use the following list commands in scripts and playbook tasks.
getList
Retrieves the contents of the specified list. The command has the following required arguments.
  • listName
    : the name of the list for which to retrieve the contents.
createList
Creates a list with the supplied data. The command has the following required arguments.
  • listName
    : the name of the list to which to append items.
  • listData
    : the data to add to the new list.
addToList
Appends the supplied items to the specified list. If you add multiple items, make sure you use the same list separator that the list currently uses, for example a comma or a semicolon. The command has the following required arguments.
  • listName
    : the name of the list to which to append items.
  • listData
    : the data to add to the specified list. The data will be appended to the existing data in the list.
setList
Adds the supplied data to the specified list and overwrites existing list data.The command has the following required arguments.
  • listName
    : the name of the list to which to append items.
  • listData
    : the data to add to the specified list. The data will overwrite the existing data in the list.
removeFromList
Removes a single item from the specified list. The command has the following required arguments.
  • listName
    : the name of the list from which to remove an item.
  • listData
    : the item to remove from the specified list.

Recommended For You