topic ip list retention in Cortex XSOAR Discussions

ip list retention

MKececioglu — Mon, 18 Apr 2022 14:07:42 GMT

Hi,

In our environment we have a list to hold ip addresses with comma seperated format, how can we provide data retention for each ip addresses within the list.

Regards.

Re: ip list retention

MBeauchamp2 — Mon, 18 Apr 2022 14:43:31 GMT

You can download the list by exporting custom content if you need a backup of it? You can also set Role permissions on who can edit the list to prevent that if you need?

Re: ip list retention

MKececioglu — Tue, 19 Apr 2022 07:38:09 GMT

Let's clarify the problem. This is the example of my ip list and one of my playbook adds or removes from this list but i want to use a TTL for each entry as i dont want to keep these ip addresses in this list forever.

1.1.1.1,2.2.2.2,3.3.3.3,12.44.55.3,5.6.6.5

Re: ip list retention

jwilkes — Tue, 19 Apr 2022 11:52:13 GMT

MKececioglu,
Good morning! Can you talk a little more about your use case, please? (why the IPs are added/removed? what they are used for? is their own interaction a single playbook?)

I think you are looking for some type of expiration for those IP addresses, and I have some ideas on this.

Re: ip list retention

jfernandes1 — Thu, 21 Apr 2022 00:12:12 GMT

Hi @MKececioglu,

This is hard to do in a list or CSV format. You'll need to create an automation that handles both the IP and the expiry date.

Another solution would be to use the indicator expiration built in to platform.

- Ingest list of IPs as IOCs

- Add specific tag for the IP list ingested
- Set the indicator expiry at ingestion time

Thanks,

Jeremy.