so the custom list in Siemplify is not a CSV-type custom list in Splunk Phantom where we can add rows and we can search for values in the playbooks. Is this correct?
custom list in Siemplify
+1
+13
This comment was originally sent by Tom Fridman
@Harrison_Dano
It's not CSV type, as you cannot add now columns to the list. It's more list a key to values dict, where the key is the category, and entity identifiers are the values. For example, a common use case for a custom list is to create a category called "VIP Assets". In the playbook, we can check if one of the involved entities (User, Host) is part of the VIP list, and go to a different branch based on the results.
+1@Tomtomfridman thanks for answering. I see. I think It will still be useful on our case scenario but editing of values dict would be a challenge since it is raw dict/json string.
Login to the community
Login with SSO
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.