04-18-2022 07:07 AM
In our environment we have a list to hold ip addresses with comma seperated format, how can we provide data retention for each ip addresses within the list.
04-18-2022 07:43 AM
You can download the list by exporting custom content if you need a backup of it? You can also set Role permissions on who can edit the list to prevent that if you need?
04-19-2022 12:38 AM
Let's clarify the problem. This is the example of my ip list and one of my playbook adds or removes from this list but i want to use a TTL for each entry as i dont want to keep these ip addresses in this list forever.
04-19-2022 04:52 AM
Good morning! Can you talk a little more about your use case, please? (why the IPs are added/removed? what they are used for? is their own interaction a single playbook?)
I think you are looking for some type of expiration for those IP addresses, and I have some ideas on this.
04-20-2022 05:12 PM
This is hard to do in a list or CSV format. You'll need to create an automation that handles both the IP and the expiry date.
Another solution would be to use the indicator expiration built in to platform.
- Ingest list of IPs as IOCs
- Add specific tag for the IP list ingested
- Set the indicator expiry at ingestion time
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!