A SOC wants to store custom watchlist values used across playbooks. Which XSOAR feature supports this?

Question

Options

• AJobs
• BLists
• CClassifiers
• DSub-playbooks

• A
  2% (1)
• B
  88% (43)
• C
  2% (1)
• D
  8% (4)

Explanation

Lists in XSOAR are purpose-built for storing reusable static data - like IP watchlists, domain blocklists, or custom indicator sets - that multiple playbooks can reference at runtime via the GetList command. Jobs (A) are scheduled triggers that run playbooks automatically; they execute actions but don't store shared data. Classifiers (C) map incoming incident fields to XSOAR incident types and fields during ingestion - they're about routing, not storage. Sub-playbooks (D) are modular playbook components that encapsulate logic for reuse, but they don't serve as a data store.

Memory tip: Think of Lists as XSOAR's "environment variables" - centrally defined values that any playbook can read, keeping your watchlist data in one place instead of hardcoded across dozens of playbooks.

No community discussion yet for this question.