Keyword lists#

Keyword lists let you define groups of terms — such as your organization’s domains, IP ranges, technologies, or product names — once, in one place, and reference them across rules, intelligence requirements, and searches. When you update the list, every object that uses it picks up the change automatically.

Find keyword lists under Data configuration > Data and templates > Keyword lists.

Permissions#

Access to keyword lists is controlled by two permissions:

  • read keyword-lists — view keyword lists and reference them in other objects (rules, intelligence requirements, searches, datasets, dashboard widgets).

  • modify keyword-lists — view and edit keyword lists.

Viewing keyword lists#

The Keyword lists page shows all keyword lists in your environment.

  • Search by name using the search bar.

  • Filter with the Show only favorite toggle, Last updated, and Last updated by.

  • Sort by clicking a column header.

  • Refresh the page with the refresh icon next to the column headers.

Each row shows the list name, an icon if a description is set, the number of keywords, who last updated the list and when, and a favorite star. Click the star to toggle favorite status directly from the listing.

Click a row to open the details pane. Select the three-dot menu on a row to View or edit or Delete the list.

Creating a keyword list#

  1. From the left sidebar, select Data configuration.

  2. Select Keyword lists.

  3. Choose + Create keyword list.

  4. Enter a name for the list. This is how the list appears in the listing and in any object that references it.

  5. (Optional) Click the star next to the name to mark the list as a favorite.

  6. (Optional) Enter a Description to help other users understand what the list is for.

  7. Review the Search query identifier. It is prefilled from the name and can be edited at this stage. Once the list is created, the identifier cannot be changed. Use the copy icon to copy the identifier — you may use it later to easily reference this list when creating searches or rules.

  8. Add Keywords to the list. Enter one keyword per line. Wildcards and exact matches are supported. A list can contain up to 1000 keywords. When the limit is reached, the message “Maximum number of lines reached” appears and further input is blocked.

    You can also paste keywords into the field:

    • If you paste multiple lines, the text is added exactly as pasted, one keyword per line.

    • If you paste a single line containing commas, semicolons, or tabs, the line is automatically split into separate keywords using the first delimiter it encounters.

  9. Select Create.

Viewing and editing a keyword list#

Click a list name on the Keyword lists page, or use View or edit from the three-dot menu, to open the details pane.

The pane has two tabs:

  • Overview — shows the description, where the list is used, the search query identifier, and the keywords. You can edit the name, favorite status, description, and keywords directly in this view. Click Save to apply changes or Cancel to discard them.

  • History — shows when the list was modified and by whom.

The Search query identifier is shown read-only here, prefixed with @ (for example, @list1). Click the copy icon to copy it.

Used in shows the number of objects that reference this list. Click Show details to see them. Referenced objects can include entity rules, discovery rules, property propagation rules, intelligence requirements, datasets, and dashboard widgets. Click an object name to open it.

Deleting a keyword list#

To delete a list, select Delete from the three-dot menu on the listing page or in the details pane.

  • If the list is referenced by other objects, a modal will inform the user how many objects use it and warns that those references will be removed.

  • If the list is not referenced anywhere, a modal confirms that no existing results or workflows will be affected.

Referencing keyword lists in other objects#

Once a keyword list is created, you can reference it in Search and other objects using its search query identifier.

In any field that supports keyword lists, type @ to open a picker showing the available lists. Lists you have marked as favorites appear at the top of the picker. Hover over the info icon next to a list name to preview its identifier, total keyword count, and the first 10 keywords.

For details on referencing keyword lists in specific objects, see: