ip list retention

[MKececioglu]

Hi,

In our environment we have a list to hold ip addresses with comma seperated format, how can we provide data retention for each ip addresses within the list.

Regards.

[MBeauchamp2]

You can download the list by exporting custom content if you need a backup of it?  You can also set Role permissions on who can edit the list to prevent that if you need?

[MKececioglu]

 Let's clarify the problem. This is the example of my ip list and one of my playbook adds or removes from this list but i want to use a TTL for each entry as i dont want to keep these ip addresses in this list forever. 

1.1.1.1,2.2.2.2,3.3.3.3,12.44.55.3,5.6.6.5

[jwilkes]

MKececioglu,
Good morning!  Can you talk a little more about your use case, please? (why the IPs are added/removed? what they are used for? is their own interaction a single playbook?)

I think you are looking for some type of expiration for those IP addresses, and I have some ideas on this.

[jfernandes1]

Hi @MKececioglu,

This is hard to do in a list or CSV format. You'll need to create an automation that handles both the IP and the expiry date. 

Another solution would be to use the indicator expiration built in to platform.

 - Ingest list of IPs as IOCs

 - Add specific tag for the IP list ingested
 - Set the indicator expiry at ingestion time

Thanks,

Jeremy.