splunk-security_content/playbooks/custom_functions/custom_list_enumerate.py

def custom_list_enumerate(custom_list=None, **kwargs):
    """
    Fetch a custom list and iterate through the rows, producing a dictionary output for each row with the row number and the value for each column.
    
    Args:
        custom_list: the name or ID of a custom list
    
    Returns a JSON-serializable object that implements the configured data paths:
        *.row_num
        *.column_0
        *.column_1
        *.column_2
        *.column_3
        *.column_4
        *.column_5
        *.column_6
        *.column_7
        *.column_8
    """
    ############################ Custom Code Goes Below This Line #################################
    import json
    import phantom.rules as phantom
    
    if not custom_list:
        raise ValueError('list_name_or_num parameter is required')
    
    outputs = []
    
    # Use REST to get the custom list
    custom_list_request = phantom.requests.get(
        phantom.build_phantom_rest_url('decided_list', custom_list),
        verify=False
    )
    
    # Raise error if unsuccessful
    custom_list_request.raise_for_status()
    
    # Get the list content
    custom_list = custom_list_request.json().get('content', [])
    
    # Iterate through all rows and save to a list of dicts
    for row_num, row in enumerate(custom_list):
        row_dict = {'column_{}'.format(col): val for col, val in enumerate(row)}
        row_dict['row_num'] = row_num
        outputs.append(row_dict)
    
    # Return a JSON-serializable object
    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
    return outputs