loadList

Load a list by name into a dataframe, optionally using a SQL filter on the table.

Operator Usage in Easy Mode

1. Click + on the Start node.
   Note: Load list is a datasource and therefore can be added under Start only.

2. Enter the Load List operator in the search field and select the operator from the Results to open the operator form.

3. In the Name drop-down, select a name of the custom list.

4. Optional. In the Filters field, apply filters for the custom list using AND or OR operator to view the result.
   If you choose AND/OR operator:

5. Enter or select a column value from the drop-down.

6. Select the operator (=, !=, >, >=, \< , \<=)

7. Enter the value to retrieve from the list.
   You can add Rule by clicking on + Rule.
   You can also create groups by clicking on + Group and repeat from step 4.

8. Click Run to view the result.

9. Click Save to add the operator to the playbook.

10. Click Cancel to discard the operator form.

Usage Details

LQL Command

Input Parameters:

list_name: The name of the list. This is a string.

filter: This is an optional parameter. It is the WHERE clause of an SQL statement. When this SQL clause is evaluated to true for an entry in the list, the entry will be loaded. An example of the filter syntax is this: "ip LIKE '%10.1.0.%'". Entries in the list that match any of the WHERE clause will be loaded.

Example

Putting this example in the syntax of the LQL would read like this:

LQL Command Example

In this example, it loads everything from the list suspicious_hosts.

LQL Command Example

In this example, it loads everything from the list suspicious_hosts if the subnet prefix of the value in the ip column in the custom list matches 192.168.1.