Use Lists in Monitors & Rule Sets

Automate Rule Sets & Monitors with Lists

Lists aren’t just for organizing data—they’re powerful automation tools! By using Lists in your Rule Sets or Monitors, you can:

• Automate prevention and detection: Trigger actions like blocking, alerting, or requiring additional checks when an identifier matches your List.
• Enable trusted access with confidence: Allow known good accounts, partners, or devices without manual approvals.
• Automate List updates in real time: Rule Sets and Monitors can now update Lists automatically with the "Add to List" action, so your defenses stay current without extra work.
• Reduce manual effort: Let expirations and API-driven updates handle cleanup and changes automatically.

Using Lists in Monitors

1. Create a new Monitor, or open an existing Monitor to edit.
2. In the Define your conditions section, choose the Lists filter.
3. In the Value field, select the List you want to apply.
4. Click Save to confirm your changes.

Using Lists in Rule Sets

1. Create a new Rule Set, or open an existing Rule Set to edit.
2. Add a new Rule, or open an existing Rule to edit.
3. In the Define your conditions section, choose the Lists filter.
4. In the Value field, select the List you want to apply.
5. Click Save to confirm your changes.

📘

Using Lists in Custom CEL expressions

You can reference Lists directly in CEL expressions by using the List’s unique UUID. Here's an example: has(event.lists) && ("76b74749-1cb3-4a1d-b14a-6cf1141b3273" in event.lists)

The above CEL expression checks whether the event references that List UUID, giving you precise, programmatic control inside your Rule Set or Monitor.