Search for a specified string in an environment custom list
Description
Search a specified string within the records of the current case environment's custom list. If no values are provided, the search returns all custom lists records.
Parameters
Parameter
Type
Default value
Is mandatory
Description
String to search
String
N/A
No
Specify string to search within the records in a custom list.
Categories
String
N/A
No
Specify the custom list category to search within.
Example
In this example, the system checks whether 1.1.1.1 is included in any records in a custom list with the category "vuln_scanner".
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eThis page provides an overview of how to manage custom lists within Google SecOps SOAR, including searching, checking, adding, and removing items.\u003c/p\u003e\n"],["\u003cp\u003eThe "Search Custom List" action allows users to search for a string within the records of a custom list, optionally within a specified category, and returns boolean results along with JSON details of the matched entries.\u003c/p\u003e\n"],["\u003cp\u003eThe "Is String In Custom List" action verifies whether a specific string exists in a designated custom list, returning a true or false value in the script and JSON results.\u003c/p\u003e\n"],["\u003cp\u003eThe "Add String to Custom List" action enables users to add a specified string to a custom list under a given category, with a success boolean in the results.\u003c/p\u003e\n"],["\u003cp\u003eThe "Remove String from Custom List" action facilitates the removal of a specified string from a custom list under a given category, with a boolean to confirm in the results.\u003c/p\u003e\n"]]],[],null,["# Lists\n=====\n\nSupported in: \nGoogle secops [SOAR](/chronicle/docs/secops/google-secops-soar-toc) \nThis document describes a set of tools that can help you manage custom lists.\n\nSearch custom list\n------------------\n\n**Description**\n\n\nSearch for a specified string within the records of a custom list. If no values are provided, the search returns all custom list records.\n\n**Parameters**\n\n**Example**\n\nIn this example, the system checks whether `.com` is included in any records in a custom list with the category \"Blocked Domains\".\n\n\n**Action configurations**\n\n**Action results**\n\n- **Script result**\n\n- **JSON result** \n\n ```\n [{\n \"entityIdentifier\": \"sample.com\", \"category\": \"Blocked Domains\", \"forDBMigration\": false, \"environments\": [\"*\"], \"id\": 1, \"creationTimeUnixTimeInMs\": 1674846992575, \"modificationTimeUnixTimeInMs\": 1674846992575\n }]\n ```\n\n*** ** * ** ***\n\nSearch for a specified string in an environment custom list\n-----------------------------------------------------------\n\n**Description**\n\n\nSearch a specified string within the records of the current case environment's custom list. If no values are provided, the search returns all custom lists records.\n\n**Parameters**\n\n**Example**\n\n\nIn this example, the system checks whether `1.1.1.1` is included in any records in a custom list with the category \"vuln_scanner\".\n\n\n**Action configurations**\n\n**Action results**\n\n- **Script result**\n\n- **JSON result** \n\n ```\n [\n {\n \"entityIdentifier\": \"1.1.1.1\",\n \"category\": \"vuln_scanner\",\n \"environments\": [\n \"Default Environment\"\n ],\n \"id\": 5,\n \"name\": \"test\",\n \"creationTimeUnixTimeInMs\": 1673953571935,\n \"modificationTimeUnixTimeInMs\": 1673953571935\n }\n ]\n ```\n\nIs string in custom list\n------------------------\n\n**Description**\n\nChecks if a string is in a custom list.\n\n**Parameters**\n`\n`\n\n`\n`**Example**\n`\n`\n\n\nIn this example, the system checks whether the IP address `0.0.0.0` exists in a list category named `bad_ips_list`.\n`\n`\n\n\n**Action configurations**\n`\n\n`\n\n`\n`\n\n**Action results**\n`\n`\n\n- **Script result**\n\n`\n`\n\n`\n`\n\n- **JSON result** \n\n ```\n {\n \"Entity\" : \"0.0.0.0\",\n \"EntityResult\" : \"true\"\n }\n ```\n\n`\n`\n\n**Add string to custom list**\n-----------------------------\n\n`\n`\n\n**Description**\n`\n`\n\nAdds a string to a custom list.\n`\n`\n\n**Parameters**\n`\n`\n\n`\n`\n\n**Example**\n`\n`\n\n\nIn this example, an IP address of `0.0.0.1` is added to a custom list category\nnamed bad_ips_list.\n`\n`\n\n\n**Action configurations**\n`\n\n`\n\n`\n`\n\n**Action results**\n`\n`\n\n- **Script result**\n\n- **JSON result** \n\n ```\n {\n \"Entity\" : \"0.0.0.0\",\n \"EntityResult\" : \"true\"\n }\n ```\n\n`\n`\n\n*** ** * ** ***\n\n`\n`\n\n**Remove string from custom list**\n----------------------------------\n\n`\n`\n\n**Description**\n`\n`\n\nRemoves a string from a custom list.\n`\n`\n\n**Parameters**\n`\n`\n\n`\n`\n\n**Example**\n`\n`\n\n\nIn this example, an IP address 0.0.0.1 is removed from a custom list category\nnamed bad_ips_list.\n`\n`\n\n\n**Action configurations**\n`\n\n`\n\n`\n`\n\n**Action results**\n`\n`\n\n- **Script result**\n\n- **JSON result** \n\n ```\n {\n \"Entity\" : \"0.0.0.0\",\n \"EntityResult\" : \"true\"\n }\n ```\n`\n`\n`\n\n`**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)\n`\n\n\n``\n\n`"]]
