topic Re: Using dynamic names in lists in playbooks in Cortex XSOAR Discussions

Using dynamic names in lists in playbooks

bowesmana — Thu, 06 Jun 2024 00:05:10 GMT

I have a sub-playbook that checks if a list exists and if not, fetches data from an external API and saves the result to that list, the next time the playbook runs it will load it from the list rather than fetching from the external API.

I want this list to be named based on the current month, but am unable to make this work as it seems I need nested variables, which require a custom script.

My current task list is (abbreviated to relevant ones)

Conditional task with IsListExist automation with a text name for the list bla_bla_bla. I am assuming I can make this ${list_name}
Task with Set automation that has the value ${lists.bla_bla_bla}
Finally createList builtin that uses the bla_bla_bla list name

So the challenge is to solve the middle task that uses the Set with ${lists.xxx}, where xxx needs to be dynamic.

Is there a way to solve this or is there an alternative way - I did originally try getList, but this seems to create a File in the context, but whose contents was some 500 error.

Re: Using dynamic names in lists in playbooks

jfernandes1 — Thu, 06 Jun 2024 02:55:33 GMT

Hi @bowesmana, I've attached a short playbook that should work for your requirement. We have an automation called TimeComponent that will work better.

In my example, I've created the error path feature instead of a conditional check. I think you might be able to use the playbook as-is, ensure that you replace the "Make some API call.." step with the actual steps for fetch the remote data.

Note: Just rename the attached file from .xml to .yml.

Re: Using dynamic names in lists in playbooks

bowesmana — Thu, 06 Jun 2024 07:31:58 GMT

Thanks @jfernandes1 - something I don't get (I'm a real newbie) is having done getList and the list is loaded, where does the list data actually go? If I turn of quiet mode, I can see the data logged, but I can't see it in the context of the playbook, so how do I actually use it? I think that was why I went down the ${lists.xxx} logic as I could put that in a Set automation and get the data into the context - with this method above, after the getList builtin runs, I don't have the data anywhere I can see.

Re: Using dynamic names in lists in playbooks

jfernandes1 — Fri, 07 Jun 2024 03:28:13 GMT

Hi @bowesmana, by default nothing is written to context. You can keep quite mode enable and add the below to the advanced tab.

Do not add anything after the equal sign (=). The syntax tells XSOAR to grab all output and add it to the listdata key.

I would also like to recommend that you have a separate step for the getList command that saves the data to the context. Before you start adding more data to context, I would suggest that you only do so:-

- When you cannot use CompareList or FilterByList commands

- When you cannot use a conditional playbook task with the In, Not In, In List or Not in List operators.