Need help with SOAR custom lists -- rows versus column updates

[RobertCEG]

I have a list of email addresses being returned by a query that I want to use to update a custom list. My goal is to have one value per row. If I add a utility block "add_to_list" to my playbook, then all the values get added in as a single row, with a separate value per column. I assume this is because the values being returned are seen as a single long comma-delimited list.

What is the best practice for ensuring my playbook is updating the custom list with just one value per row, and adding new rows for each value in my list?

[livehybrid]

Hi @RobertCEG

Pass the list of email addresses as a list/array to the "add_to_list" utility block, not as a single comma-delimited string.

Use a playbook block (e.g., "Format" or "Custom Function") to ensure your email addresses are output as a list/array.

Connect this output directly to the "add_to_list" block.

Example (pseudo) code for a Custom Function:

def add_emails_to_list(email_string):
    # Split comma-separated string into a list
    return [email.strip() for email in email_string.split(',')]

Then, pass the resulting list to "add_to_list".

If you pass a single string (even if comma-separated), SOAR treats it as one row with multiple columns. Passing a list/array adds each value as a new row.

Check the output type from your previous block—ensure it is a list, not a string.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing