topic Deleting Custom List Items in Splunk SOAR

Deleting Custom List Items

CS_ — Tue, 21 Jun 2022 13:30:09 GMT

In a playbook, I have a decision tree.

If option A -> Check List -> If Value Exists in custom list -> Do Nothing

Else If Option b -> Check list -> If Value Exists in custom list -> Delete that list entry.

Checking in the SOAR Phantom app actions, I see several options for lists, but no option to "remove/delete listitem" (see attached pic)

How do I go about deleting items from a Custom List?

Thanks!

(SOAR Cloud 5.3.1)

phanTom — Tue, 21 Jun 2022 13:38:14 GMT

There is an API to perform this in a code block or custom function:

Otherwise you can rebuild the list without the value(s) and then use set_list to overwrite:

CS_ — Tue, 21 Jun 2022 13:42:06 GMT

@phanTomAs always, you've dropped the perfect answer. Many thanks!

I'll give this a try (from the first URL you provided)

phantom.delete_from_list(list_name=None, value=None, column=None, remove_all=False, remove_row=False)