---
name: cis-managed-lists
title: Using managed lists
description: CIS provides managed lists you can use in rule expressions. These lists are regularly updated.
last-updated: 2026-04-29
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/cis?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Using managed lists
{: #using-managed-lists}

CIS provides managed lists you can use in rule expressions. These lists are regularly updated.

## Managed IP lists
{: #managed-ip-lists}

You can access CIS IP threat intelligence through managed IP lists. CIS offers several managed IP lists, but the specific lists available to you depend on your subscription plan.

| Display name | Name in expressions | Description |
| ------------ | ------------------- | ----------- |
| Cloudflare Open Proxies | `cf.open_proxies` | IP addresses of known open HTTP and SOCKS proxy endpoints, which are frequently used to launch attacks and hide attackers identity.|
| Cloudflare Anonymizers | `cf.anonymizer` | IP addresses of known anonymizers (open SOCKS proxies, VPNs, and TOR nodes). |
| Cloudflare VPNs | `cf.vpn` | IP addresses of known VPN servers. |
| Cloudflare Malware | `cf.malware` | IP addresses of known sources of malware. |
| Cloudflare Botnets, Command and Control Servers | `cf.botnetcc` | IP addresses of known botnet command-and-control servers. |
{: caption="Available managed IP lists" caption-side="bottom"}



## Listing managed lists in an instance from the CLI
{: #listing-managed-lists-cli}
{: cli}

To list managed lists in an instance from the CLI, run the following command:

```sh
cis managed-lists [-i, --instance INSTANCE] [--output FORMAT]
```
{: pre}

### Command options
{: #command-listing-managed-lists-cli}

`-i, --instance`
:   Instance name or ID. If instance name or ID is not set, the context instance specified by `cis instance-set INSTANCE` is used.

`--output`
:   Specify output format, only JSON is supported now.

### Command example
{: #example-listing-managed-lists-cli}

```sh
ibmcloud cis managed-lists --instance crn:v1:staging:public:internet-svcs-ci:global:a/c987fg3e4h278745690dp435683568rp:eg7kb437-4893-56yl-4wn9-c595j8t78gr9:: --output json
```
{: pre}

## Listing managed lists in an instance with the API
{: #listing-managed-lists-api}
{: api}

The following example lists managed lists in an instance:
```sh
curl -X GET https://api.cis.cloud.ibm.com/v1/$CRN/rules/managed_lists \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'X-Auth-User-Token: Bearer xxxxxx'
```
{: pre}

## Listing managed lists in an instance with Terraform
{: #listing-managed-lists-terraform}
{: terraform}

The following example lists managed lists in an instance:

```terraform
data ibm_cis_managed_lists managed_lists {
    cis_id    = "crn:v1:staging:public:internet-svcs-ci:global:a/01652b251c3ae2787110a995d8db0135:1a9174b6-0106-417a-844b-c8eb43a72f63::"
}
```
{: codeblock}