Defining a Known User Object List for Automated Playbook Logic in XSOAR

[Chamindu]

I need to define a known user list as an Object List so that the playbook can automatically check it. If the username involved in the incident is found in this known list, the condition should pass and the incident should move forward toward automatic resolution.

How do we properly define a list inside the playbook and configure the logic so that when a username matches an entry in that list, the playbook proceeds to the next step?

[ofmoalem]

Hi,

There are multiple options for achieving your goal - automated close of specific user related incidents.

*NOTE* - personally, i would not recommend you automatically closing incidents based on usernames only but this part is your call 🙂

1. pre-processing rule using the built-in feature:

Settings->Object Setup->Pre-Process Rules->New Rule button

•  This will give you the ability to run transformers (Scripts with transformer tag) on the incident context data and validate username involved. using simple code logic you can return True/False and by that match a filter on when you want to close / ingore the incident

2. Playbook Method

You can create a dynamic list in:

Settings->Advanced->Lists->Add a list button

• choose your list type of data (JSON,txt)
• add relevant users the the list (if txt has been choosen then use a the list as the following "list like string": Username1, Username2 where comma is your delimiter (similar to python)
• use the demisto.executeCommand("getList", {"listName": *listname you used*}) to get the list values
• use the demisto.executeCommand("addToList", {"listName":"", "listData":""}) to add values to the list

then - the usage is pretty much up to you - use Condition + transformer code (as suggested above before), playbook tasks (with getList) and contidion etc etc.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Work-W...

feel free to reach again if you need to 🙂

best of luck!