This action type can be used to add a constant value or the value of an event attribute (such as Destination IP or Source User Name) to an existing Dynamic List. Any values that are repeated across multiple events will only be added to the dynamic list once. The various parameters available are:
Element Values Enter a constant value here.
Element Type Persistent or Transient
Dynamic List Name Choose an existing Dynamic List from the dropdown menu.
Attribute Names For every event that is part of a correlated event, the value or values of this event attribute will be added to the Dynamic List.
If there are entries for both Element Values and Attribute Names, both will be added to the Dynamic List when the rule fires. If the Element Value is filled in and the Element Type is Transient, the timestamp for the element in the Dynamic List will be updated each time the rule fires.