Splunk SOAR

Is there a way to get all Custom Lists with phantom api?

GeorgeOrwell
Explorer

I'm looking for a way to collect all custom lists.  While I can do so individually for every Custom List with `phantom.get_list()` I still need to have their names to make use of this function. So, is there a way to get all Custom Lists names, or Custom Lists' contents? 
As a workaround I tried making request to "/rest/decided_list", but it doesn't return everything that is accessible through phantom itself. 

0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@GeorgeOrwell are you adding any page_size argument to the REST call??

decided_list is the right endpoint for ALL lists on the platform but REST calls usually have a page limit.

Try:

/rest/decided_list?page_size=0

 

Here is the docs for all the query items you can use for REST:
https://docs.splunk.com/Documentation/SOARonprem/5.3.2/PlatformAPI/RESTQueryData 

View solution in original post

Tags (1)

phanTom
SplunkTrust
SplunkTrust

@GeorgeOrwell are you adding any page_size argument to the REST call??

decided_list is the right endpoint for ALL lists on the platform but REST calls usually have a page limit.

Try:

/rest/decided_list?page_size=0

 

Here is the docs for all the query items you can use for REST:
https://docs.splunk.com/Documentation/SOARonprem/5.3.2/PlatformAPI/RESTQueryData 

Tags (1)
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...