# How do you handle lists in rules **URL:** \ **Category:** Elastic Security\ **Tags:** detection-rules\ **Created:** [February 15, 2023, 8:25am UTC](https://discuss.elastic.co/t/how-do-you-handle-lists-in-rules/325558 "2023-02-15T08:25:53Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![m-logs](https://avatars.discourse-cdn.com/v4/letter/m/90db22/32.png) [@m-logs](https://discuss.elastic.co/u/m-logs)\ **Post date:** [February 15, 2023, 8:25am UTC](https://discuss.elastic.co/t/how-do-you-handle-lists-in-rules/325558/1 "2023-02-15T08:25:53Z")
Hello everyone, Imagine the following szenario: You have a bigger infrastructure and you have different systems in that environment. Let's say you have different rule approaches to several subsets of systems (identified by IP addresses). And you like to manage this sets of systems in one place. =\> The problem for me currently is: List are not allowed in rules, which means when I have multiple rules that target a specific subset of systems I have to change each rule. Is it possible to centralize such system identifiers? The current options that I figured out so far are the following: - Maybe use building blocks and check for triggers - Use the pipeline in order to tag systems How do you do this for yourself? ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [February 16, 2023, 9:11am UTC](https://discuss.elastic.co/t/how-do-you-handle-lists-in-rules/325558/2 "2023-02-16T09:11:58Z")
We are having similar issues. Lists should be reusable somehow. For example a list of user names of developers who are triggering alerts on several rules. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 16, 2023, 9:12am UTC](https://discuss.elastic.co/t/how-do-you-handle-lists-in-rules/325558/3 "2023-03-16T09:12:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.