Splunk SOAR

Is there a way to get all Custom Lists with phantom api?

GeorgeOrwell
Explorer

I'm looking for a way to collect all custom lists.  While I can do so individually for every Custom List with `phantom.get_list()` I still need to have their names to make use of this function. So, is there a way to get all Custom Lists names, or Custom Lists' contents? 
As a workaround I tried making request to "/rest/decided_list", but it doesn't return everything that is accessible through phantom itself. 

0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@GeorgeOrwell are you adding any page_size argument to the REST call??

decided_list is the right endpoint for ALL lists on the platform but REST calls usually have a page limit.

Try:

/rest/decided_list?page_size=0

 

Here is the docs for all the query items you can use for REST:
https://docs.splunk.com/Documentation/SOARonprem/5.3.2/PlatformAPI/RESTQueryData 

View solution in original post

Tags (1)

phanTom
SplunkTrust
SplunkTrust

@GeorgeOrwell are you adding any page_size argument to the REST call??

decided_list is the right endpoint for ALL lists on the platform but REST calls usually have a page limit.

Try:

/rest/decided_list?page_size=0

 

Here is the docs for all the query items you can use for REST:
https://docs.splunk.com/Documentation/SOARonprem/5.3.2/PlatformAPI/RESTQueryData 

Tags (1)
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...