Adding to a Dynamic List

Figure 3 Adding to a Dynamic List

NOTE:This type of action can only be used in Correlation deployments.

This action type can be used to add a constant value or the value of an event attribute (such as Target IP or Initiator User Name) to an existing dynamic list. Any values that are repeated across multiple events are only added to the dynamic list once. The various parameters available are:

Table 5 Parameters

Option

Function

Element Values

(Optional) Specify a constant value to add to the dynamic list. If this is blank, Attribute Name must be populated.

Element Type

Persistent or Transient.

Dynamic List Name

Select an existing dynamic list from the drop-down menu.

Attribute Names

(Optional) For every event that is part of a correlated event, the value or values of the selected event attribute are added to the dynamic list. If this is blank, element values must be populated.

If there are entries for both Element Values and Attribute Names, both are added to the dynamic list when the rule fires. If the Element Value is filled in and the Element Type is Transient, the time stamp for the element in the dynamic list is updated each time the rule fires.

For trademark and copyright information, see Legal Notices.