Create custom lists

Supported in:

Google SecOps SOAR

You can define lists of special interest, for example, hosts holding confidential information or users who have come under suspicion. These custom lists can be selected as triggers for Playbooks. You can also choose to download a template with sample data, use this format to add lists (categories) and then import the information back in. This can be useful if you are a new customer and want to import existing information into the platform.

Note: You can define identifiers for multiple environments by separating the environments with a vertical line, for example: Default Environment|customer_123. If you enter the asterix sign for environment, the identifier will be defined for all environments.

To add a new custom list:

1. Navigate to SOAR Settings > Environments > Custom Lists
2. Click on the top right of the screen.
3. Enter the relevant information into the Add Custom List dialog.
4. Click Add.

Need more help? Get answers from Community members and Google SecOps professionals.