---
title: Using lists in rules
summary: null
url: >-
https://www.fastly.com/documentation/guides/next-gen-waf/rules/using-lists-in-rules
---
Lists are sets of data that can be referenced by multiple [rules](https://www.fastly.com/documentation/guides/next-gen-waf/rules/about-rules/). They help centralize data management. For example, a list of prohibited countries can be applied to separate rules, such as one to track registration attempts and another to track login attempts. If the list of prohibited countries changes, only the list needs to be updated, not the individual rules.
## Limitations and considerations
When working with lists, keep the following things in mind:
- Lists are not included with the [Essential platform](https://docs.fastly.com/products/fastly-next-gen-waf#feature-availability).
- Lists are limited to 25 per corp (account) plus 25 per site (workspace).
- Lists can contain a maximum of 5000 items.
- Lists support CIDR notation for IP address ranges.
- String and wildcard lists do not support comments.
## Types of lists
A list's type determines where you can use it and who manages it. There are three types:
- **Site lists (also known as Workspace lists):** lists that you create for use within a single site (workspace).
- **Corp lists (also known as Account lists):** lists that you create for use in both corp rules (account rules) and site rules (workspace rules). Only owners (superusers) can create, edit, and delete this list type.
- **System lists:** lists provided by Fastly for use in both corp rules (account rules) and site rules (workspace rules). You cannot modify system lists.
> **HINT:** When creating a rule, you can view the contents of a system list that contains signals. After selecting a system list in the Conditions area of the rule builder, click the **Preview list** link. You cannot preview IP-based system lists.
## Supported data types
Lists can consist of the following types of data:
- Countries
- IP addresses
- Signals
- Strings (e.g., agent names)
- [Wildcards](https://www.fastly.com/documentation/guides/next-gen-waf/rules/defining-rule-conditions/#wildcards)
Lists with countries or IP addresses can contain comments. To add a comment to a site list (workspace list) or corp list (account list), use the pound sign `#` for the comment character as demonstrated below.
```plain
192.0.2.0/24
198.51.100.0/24
# example comment
203.0.113.0/24
```
## Creating lists
You can create corp lists (account lists) and site lists (workspace lists).
### Creating corp lists (account lists)
To create corp lists (account lists), complete the following steps:
### Next Gen Waf Control Panel
1. Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).
2. From the **Corp Rules** menu, select **Corp Lists**.
3. Click **Add corp list**.
4. From the **Type** menu, select the type of data the list will contain.
5. In the **Name** field, enter the name of the list.
6. _(Optional)_ In the **Description (optional)** field, enter a description for the list.
7. In the **Entries** field, enter the items that will comprise the list. Each entry must be on its own line.
8. Click **Create corp list**.
### Fastly Control Panel
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Security** > **Next-Gen WAF** > [**Lists**](https://manage.fastly.com/security/ngwaf/lists).
3. From the workspaces bar, click the menu 
to the right of the workspace name and select your account name.
4. Click **Add account list**.
5. From the **Type** menu, select the type of data the list will contain.
6. In the **Name** field, enter the name of the list.
7. _(Optional)_ In the **Description** field, enter a description for the list.
8. In the **Entries** field, enter the items that will comprise the list. Each entry must be on its own line.
9. Click **Create account list**.
### Creating site lists (workspace lists)
To create site lists (workspace lists), complete the following steps:
### Next Gen Waf Control Panel
1. Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).
2. From the **Sites** menu, select a site if you have more than one site.
3. From the **Rules** menu, select **Site Lists**.
4. Click **New list**.
5. From the **Type** menu, select the type of data the list will contain.
6. In the **Name** field, enter the name of the list.
7. _(Optional)_ In the **Description (optional)** field, enter a description for the list.
8. In the **Entries** field, enter the items that will comprise the list. Each entry must be on its own line.
9. Click **Create site list**.
### Fastly Control Panel
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Security** > **Next-Gen WAF** > [**Lists**](https://manage.fastly.com/security/ngwaf/lists).
3. From the workspaces bar, click the menu to the right of the workspace name and select a workspace.
4. Click **Add workspace list**.
5. From the **Type** menu, select the data type of the list (e.g., countries and IP addresses).
6. In the **Name** field, enter the name of the list.
7. In the **Description** field, enter a description of the list.
8. In the **Entries** field, enter the items that will comprise the list. Each entry must be on its own line.
9. Click **Create workspace list**.
## Updating lists
You can update corp lists (account lists) and site lists (workspace lists).
### Updating corp lists (account lists)
To update corp lists (account lists), complete the following steps:
### Next Gen Waf Control Panel
1. Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).
2. From the **Corp Rules** menu, select **Corp Lists**.
3. Click **View** to the right of the list that you want to edit.
4. Click **Edit corp list**.
5. _(Optional)_ In the **Description (optional)** field, enter a description for the list.
6. In the **Entries** field, enter the items that will comprise the list. Each entry must be on its own line.
7. Click **Update corp list**.
### Fastly Control Panel
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Security** > **Next-Gen WAF** > [**Lists**](https://manage.fastly.com/security/ngwaf/lists).
3. From the workspaces bar, click the menu to the right of the workspace name and select your account name.
4. Click the pencil 
to the right of the list that you want to edit.
5. In the **Description** field, enter a description of the list.
6. In the **Entries** field, enter the items that will comprise the list. Each entry must be on its own line.
7. Click **Update account list**.
### Updating site lists (workspace lists)
To update site lists (workspace lists), complete the following steps:
### Next Gen Waf Control Panel
1. Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).
2. From the **Sites** menu, select a site if you have more than one site.
3. From the **Rules** menu, select **Site Lists**.
4. Click **View** to the right of the list that you want to edit.
5. Click **Edit site list**.
6. _(Optional)_ In the **Description (optional)** field, enter a description for the list.
7. In the **Entries** field, enter the items that will comprise the list. Each entry must be on its own line.
8. Click **Update site list**.
### Fastly Control Panel
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Security** > **Next-Gen WAF** > [**Lists**](https://manage.fastly.com/security/ngwaf/lists).
3. From the workspaces bar, click the menu to the right of the workspace name and select a workspace.
4. Click the pencil to the right of the list that you want to edit.
5. In the **Description** field, enter a description of the list.
6. In the **Entries** field, enter the items that will comprise the list. Each entry must be on its own line.
7. Click **Update workspace list**.
## Deleting lists
You can delete corp lists (account lists) and site lists (workspace lists).
### Deleting corp lists (account lists)
To delete corp lists (account lists), complete the following steps:
### Next Gen Waf Control Panel
1. Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).
2. From the **Corp Rules** menu, select **Corp Lists**.
3. Click **View** to the right of the list that you want to edit.
4. Click **Remove corp list** and then **Delete corp list**. The list is deleted, and the Corp Lists page appears.
### Fastly Control Panel
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Security** > **Next-Gen WAF** > [**Lists**](https://manage.fastly.com/security/ngwaf/lists).
3. From the workspaces bar, click the menu to the right of the workspace name and select your account name.
4. Click the trash 
to the right of the name of the list that you want to delete and then click **Delete account list**. The list is deleted, and the Account lists page appears.
### Deleting site lists (workspace lists)
To delete site lists (workspace lists), complete the following steps:
### Next Gen Waf Control Panel
1. Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).
2. From the **Sites** menu, select a site if you have more than one site.
3. From the **Rules** menu, select **Site Lists**.
4. Click **View** to the right of the list that you want to delete.
5. Click **Remove site list** and then **Delete site list**. The list is deleted, and the Site Lists page appears.
### Fastly Control Panel
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Security** > **Next-Gen WAF** > [**Lists**](https://manage.fastly.com/security/ngwaf/lists).
3. From the workspaces bar, click the menu to the right of the workspace name and select a workspace.
4. Click the trash to the right of the name of the list that you want to delete and then click **Delete workspace list**. The list is deleted, and the Lists page appears.
## Using lists
When [creating rules](https://www.fastly.com/documentation/guides/next-gen-waf/rules/about-rules/), you can base rule conditions on lists by filling out the fields in the **Conditions** section as follows:
1. From the **Field** menu, select the field that relates to the list you want to use. For example, select **IP address** if the relevant list is comprised of IP addresses.
2. From the **Operator** menu, select **Is in list** or **Is not in list**.
3. From the **Value** menu, select the appropriate list.
## Related content
- [About rules](https://www.fastly.com/documentation/guides/next-gen-waf/rules/about-rules)
- [Using an API with the Next-Gen WAF](https://www.fastly.com/documentation/guides/next-gen-waf/developer/using-an-api-with-the-next-gen-waf)