Work With Lists

Manage lists in Cortex XSOAR that can be accessed by automations, playbooks, etc. List commands, lists arrays separators delimiters
A list is a data container where you can globally store data within Cortex XSOAR. Despite the name
lists
, the data can be in any text format, and can even store files. The data within lists can be accessed within automations, playbooks, or any other place where the context button appears (double-curly brackets). In a playbook, you can access the data in a list via the context button under
Lists
, or by using the path
${lists.<list_name>}
.
The maximum list size is 209715 characters.
  • Create a list
    When creating a list, you can select the content type (Text, Markdown, HTML, JSON or CSS) and whether you want to limit permissions for read and write or read only.
    You can change the content type without editing the list. You cannot edit truncated lists (only download).
    If a valid JSON is stored within a list, it will automatically be parsed as a JSON object when you access it from within a playbook. Depending on how you store the data, you may need to transform a list into an array.
    When you access a list using the built-in list or base pack commands, the data is considered to be comma-separated unless you specifically define a custom separator for the list. When using built-in commands, you do not need to split the list. However, if you want to use non-built-in commands, such as in an automation or to loop over list items, you need to split the list using a transformer.
  • Upload/download a list.
  • In a remote repository, lists can be pushed from to a production environment. When the list is pushed to production, you cannot edit the list, but you can change it from the CLI (such as the
    addToList
    command) or in a playbook. If a list has been pushed to production that already exists with the same name, you can resolve the conflict. You can still create lists in production.
  • (
    Multi-tenant)
    You can propagate lists from the Main Account to tenants.
Lists can be included in a Content Pack and be installed from the Marketplace.

Use cases

These are some common use cases for creating and using lists in Cortex XSOAR.
  • A list of allowed executable files against which to check potentially malicious executable files.
  • An HTML template that you can define to use as part of a Communication task.
  • Store data object, for example JSON, that you can call as inputs for scripts and playbooks.
  • Use the
    getList
    or
    addToList
    commands in a script to take action based on the list data, for example,
    res = demisto.executeCommand("getList", {"listName": demisto.args()["listName"]})
    will return all list entries in the script.

List commands

You can use the following list commands in scripts and playbook tasks.
Command
Description
Arguments
getList
Retrieves the contents of the specified list.
listName
: The name of the list for which to retrieve the contents.
createList
Creates a list with the supplied data.
  • listName
    : The name of the list to which to append items.
  • listData
    : The data to add to the new list.
addToList
Appends the supplied items to the specified list. If you add multiple items, make sure you use the same list separator that the list currently uses, for example a comma or a semicolon.
  • listName
    : The name of the list to which to append items.
  • listData
    : The data to add to the specified list. The data will be appended to the existing data in the list.
setList
Adds the supplied data to the specified list and overwrites existing list data.
  • listName
    : The name of the list to which to append items.
  • listData
    : The data to add to the specified list. The data overwrites the existing data in the list.
removeFromList
Removes a single item from the specified list.
  • listName
    : The name of the list from which to remove an item.
  • listData
    : The item to remove from the specified list.

Recommended For You