Skip to main content
Skip table of contents

Updated Global List

LAST UPDATED: JAN 21, 2025

The process of adding and modifying a global list is now more streamlined, featuring an updated layout, two distinct editor modes, and a newly introduced audit log tab.

Group 115.png

Adding a Global List

  1. Navigate to Configuration > Global List, then click on the + Global List button.

    Group 116.png
  2. Enter a name for the global list, then click on the Submit button to configure it.

    Group 117.png
  1. Click on either of the + Add Data buttons.

    Group 118.png
  2. Enter the data using the code editor or form editor.

    Group 119.png

    The code snippet provided below is identical to the one displayed in the image.

    JSON
    [
        {
            "Sender": "ceo@example.com",
            "Type": "Email Address",
            "Description": "Trusted email address for the CEO."
        },
        {
            "Sender": "hr@company.com",
            "Type": "Domain",
            "Description": "Trusted domain for HR communications."
        },
        {
            "Sender": "support@partner.com",
            "Type": "Email Address",
            "Description": "Support email for a verified business partner."
        },
        {
            "Sender": "sales@trustedvendor.com",
            "Type": "Domain",
            "Description": "Domain for communications from an approved vendor."
        },
        {
            "Sender": "alerts@reputable-service.com",
            "Type": "Email Address",
            "Description": "Trusted source for operational alerts."
        }
    ]
  3. Click on the Save button to save the global list.

    Group 122.png
  4. Confirm that the global list is displayed as expected.

    Group 150 (1).png

    Users can switch to viewing the global list in a tabular format by clicking the Group 151.png icon.

    different_views.gif
  5. Choose the site where the global list will be used.

    Group 152.png

    1. Select the Permission tab.

    2. Select one or multiple sites.

    3. Click on the Group 132.png button.

Adding Data with the Form Editor
  1. Click on the form editor icon to switch the editor mode.

    Group 125.png
  2. Click on the Group 127.png to delete the placeholder content.

    Group 126.png
  3. Click on the + JSON Object button.

    Group 128.png

    The + JSON Object button duplicates Object 1 if it is present.

  4. Add a new key.

    Group 129 (3).png
    1. Click on the + New Key button.

    2. Enter a name for the key.
      To update or delete the key name, switch to the code editor to make the changes.

      mistake.gif
    3. Click on the + Add button.

  5. Select the appropriate data type, then enter the value for the key.

    Group 130 (3).png
  6. Repeat steps 1-5 as necessary.

  7. Click on the Group 131.png (Save) button.

Using the Global List

  1. Select an existing preprocessing or investigation playbook, or create a new one.

    Group 133.png
  2. Select any task that allows for dynamic inputs, such as a conditional task.

    Group 134.png
  3. For the conditional task type, follow these steps to use dynamic input data to configure the condition settings.

    Group 135.png
    1. Click on the Condition Settings tab.

    2. Select the Dynamic Input option.

    3. Click on the Group 136.png (Format Builder) button.

  4. Retrieve data dynamically from the newly created global list. In this example, the sender data will be extracted.

    Group 137.png
    1. Select the Global List data source.

    2. Locate the global list and click on the Group 138.png button to open it.

    3. Select the Sender field.

  5. Click on the Group 140.png button, then select the Generate as Variable option.

    Group 139.png

RESULT

The user can now use the variable to configure inputs for any task supporting dynamic values, such as a conditional task, as shown below.

CODE
{% set tld_list = [] %}

{% set senders = GlobalList | jsonpath('$.["Allowed Senders"][*].Sender') %}

{% for sender in senders %}
    {% set tld = sender.split('.')[-1] %}
    {{ tld_list.append(tld) or "" }}
{% endfor %}

{% set sender_tld = PlaybookData | jsonpath('$.["Get Sender TLD"].returnData.TLD') %}

{% if sender_tld in tld_list %}
    Not Suspicious TLD
{% else %}
    Suspicious TLD
{% endif %}

This code snippet extracts the list of senders from the global list, splits each sender's email to retrieve its top-level domain (TLD), and appends these TLDs to a variable called tld_list. The code then compares the TLD from the playbook data against tld_list to determine whether or not the TLD is suspicious.

Deactivating and Deleting a Global List

To delete or deactivate a global list, click the Group 153.png button to access these options.

Group 141.png

Deactivating a Global List

To deactivate a global list, click on the Active Global List toggle.

Group 142.png
  • On Group 143.png

  • Off Group 144.png

A deactivated global list cannot be used as a data source for dynamic inputs.

Deleting a Global List

To delete a global list, click on the Delete Global List option.

Group 145.png

Before deleting a global list, verify that it is not referenced by other features, such as a playbook task or a codeless playbook task to avoid execution failures.

Using the Audit Log

The Audit Log tab records all modifications to the global list, detailing the user who made the change, the time of the modification, and the nature of the change.

Group 149.png

Updating the Name and Description of the Global List

Users can update the global list's name and description by clicking the fields, making the desired changes, and clicking the Group 150.png button to save the updates.

changinggloballistname.gif

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.