Add to Dynamic List

This action type can be used to add a constant value or the value of an event attribute (such as Destination IP or Source User Name) to an existing Dynamic List. Any values that are repeated across multiple events will only be added to the dynamic list once. The various parameters available are:

If there are entries for both Element Values and Attribute Names, both will be added to the Dynamic List when the rule fires. If the Element Value is filled in and the Element Type is Transient, the timestamp for the element in the Dynamic List will be updated each time the rule fires.