Using Lists in Monitors & Workflows

Automate Workflows & Monitors with Lists

Lists aren’t just for organizing data—they’re powerful automation tools! By using Lists in your Workflows or Monitors, you can:

• Automate prevention and detection: Trigger actions like blocking, alerting, or requiring additional checks when an identifier matches your List.
• Enable trusted access with confidence: Allow known good accounts, partners, or devices without manual approvals.
• Automate List updates in real time: Workflows and Monitors can now update Lists automatically with the "Add to List" action, so your defenses stay current without extra work.
• Reduce manual effort: Let expirations and API-driven updates handle cleanup and changes automatically.

Using Lists in Monitors

1. Create a new Monitor, or open an existing Monitor to edit.
2. In the Define your conditions section, choose the Lists filter.
3. In the Value field, select the List you want to apply.
4. Click Save to confirm your changes.

Using Lists in Workflows

1. Create a new Workflow, or open an existing Workflow to edit.
2. Add a new Rule, or open an existing Rule to edit.
3. In the Define your conditions section, choose the Lists filter.
4. In the Value field, select the List you want to apply.
5. Click Save to confirm your changes.

📘

Using Lists in Custom CEL expressions

You can reference Lists directly in CEL expressions by using the List’s unique UUID. Here's an example: has(event.lists) && ("76b74749-1cb3-4a1d-b14a-6cf1141b3273" in event.lists)

The above CEL expression checks whether the event references that List UUID, giving you precise, programmatic control inside your Workflow or Monitor.