RFPD-22681: Splunk SOAR - Combine List Search and List Details into one action

[vallysenok]

Details

Consolidates list search and list details actions by adding list_id as an optional parameter to list search.

• Added list_id as an optional parameter to the list search action, allowing users to look up a specific list by ID without needing a separate action (when provided, returns details for a specific list via /list/{list_id}/info).
• Deprecated the list details action - it now emits a visible warning (save_progress) and its description is updated to direct users to list search with list_id instead.
• Added unit test coverage for all connector actions.

Summary

Two actions list search (filter by name/type) and list details (lookup by ID) will returned identical output but served different input patterns. Rather than merging them (which would blur the architectural separation of filter-based vs. ID-based lookups), list_id was added as an optional parameter to list search. This gives users flexibility while keeping both actions clean and focused. list details is preserved for backwards compatibility but marked as deprecated for future removal.

[nazarii-plebanskyi-rf]

General question: does the list search action always return a list? Or is it returning an object when list_id is specified?

[Copilot]

Pull request overview

This PR consolidates list lookup behavior by allowing the existing list search action to optionally fetch a single list’s details via list_id, while keeping list details for backward compatibility (now deprecated) and expanding unit test coverage across connector actions.

Changes:

• Added optional list_id parameter to list search to perform GET /list/{list_id}/info when provided.
• Deprecated the list details action via a visible runtime warning and updated descriptions/docs accordingly.
• Added/expanded pytest coverage for a broad set of connector actions (alerts, intelligence, reputation, list actions, etc.).

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
recordedfuture_connector.py	Adds list_id handling to list search and emits deprecation warning for list details; small robustness fix for intelligence 404 handling.
recordedfuture.json	Updates action schema to include list_id on list search and marks list details as deprecated in its description.
README.md	Documents list_id parameter for list search and flags list details as deprecated.
release_notes/unreleased.md	Adds unreleased note about the list search/list details consolidation.
tests/test_list_search.py	Adds unit tests for list search behavior with list_id and verifies list details deprecation warning.
tests/test_*.py (multiple)	Adds unit tests for additional connector actions (alerts, intelligence, reputation, playbook alerts, misc).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vallysenok]

General question: does the list search action always return a list? Or is it returning an object when list_id is specified?

Yes, the two code paths return different shapes:

• With list_id: calls GET /list/{list_id}/info → the API returns a single object (one list's info dict)
• Without list_id: calls POST /list/search → the API returns a list/array of matching lists
  Both paths feed the raw response directly into action_result.add_data(response_obj) via _get_list_action_result, so the data type is whatever the API returns an object for the list_id path a list for the search path.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.