ip list retention

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

ip list retention

L2 Linker

Hi,

 

In our environment we have a list to hold ip addresses with comma seperated format, how can we provide data retention for each ip addresses within the list.

 

Regards.

4 REPLIES 4

L2 Linker

You can download the list by exporting custom content if you need a backup of it?  You can also set Role permissions on who can edit the list to prevent that if you need?

 

 

L2 Linker

 Let's clarify the problem. This is the example of my ip list and one of my playbook adds or removes from this list but i want to use a TTL for each entry as i dont want to keep these ip addresses in this list forever. 

 

1.1.1.1,2.2.2.2,3.3.3.3,12.44.55.3,5.6.6.5

MKececioglu,
Good morning!  Can you talk a little more about your use case, please? (why the IPs are added/removed? what they are used for? is their own interaction a single playbook?)

I think you are looking for some type of expiration for those IP addresses, and I have some ideas on this.

L4 Transporter

Hi @MKececioglu,

 

This is hard to do in a list or CSV format. You'll need to create an automation that handles both the IP and the expiry date. 

 

Another solution would be to use the indicator expiration built in to platform.

 - Ingest list of IPs as IOCs

 - Add specific tag for the IP list ingested
 - Set the indicator expiry at ingestion time

 

Thanks,

 

Jeremy.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!