In a playbook, I have a decision tree.
If option A -> Check List -> If Value Exists in custom list -> Do Nothing
Else If Option b -> Check list -> If Value Exists in custom list -> Delete that list entry.
Checking in the SOAR Phantom app actions, I see several options for lists, but no option to "remove/delete listitem" (see attached pic)
How do I go about deleting items from a Custom List?
Thanks!
(SOAR Cloud 5.3.1)
There is an API to perform this in a code block or custom function:
https://docs.splunk.com/Documentation/SOAR/current/PlaybookAPI/DataManagementAPI#delete_from_list
Otherwise you can rebuild the list without the value(s) and then use set_list to overwrite:
https://docs.splunk.com/Documentation/SOAR/current/PlaybookAPI/DataManagementAPI#set_list
There is an API to perform this in a code block or custom function:
https://docs.splunk.com/Documentation/SOAR/current/PlaybookAPI/DataManagementAPI#delete_from_list
Otherwise you can rebuild the list without the value(s) and then use set_list to overwrite:
https://docs.splunk.com/Documentation/SOAR/current/PlaybookAPI/DataManagementAPI#set_list