Skip to main content


so the custom list in Siemplify is not a CSV-type custom list in Splunk Phantom where we can add rows and we can search for values in the playbooks. Is this correct?


This comment was originally sent by Tom Fridman


@Harrison_Dano
It's not CSV type, as you cannot add now columns to the list. It's more list a key to values dict, where the key is the category, and entity identifiers are the values. For example, a common use case for a custom list is to create a category called "VIP Assets". In the playbook, we can check if one of the involved entities (User, Host) is part of the VIP list, and go to a different branch based on the results.



@Tomtomfridman
thanks for answering. I see. I think It will still be useful on our case scenario but editing of values dict would be a challenge since it is raw dict/json string.


Reply