Figure 3 Adding to a Dynamic List
NOTE:This type of action can only be used in Correlation deployments.
This action type can be used to add a constant value or the value of an event attribute (such as Target IP or Initiator User Name) to an existing dynamic list. Any values that are repeated across multiple events are only added to the dynamic list once. The various parameters available are:
Table 5 Parameters
If there are entries for both
and , both are added to the dynamic list when the rule fires. If the Element Value is filled in and the Element Type is Transient, the time stamp for the element in the dynamic list is updated each time the rule fires.For trademark and copyright information, see Legal Notices.