Adding To A Dynamic List - Novell SENTINEL RAPID DEPLOYMENT 6.1 - 12-2009 User Manual

4.6.2 Adding to a Dynamic List

Figure 4-3
NOTE: This type of action can only be used in Correlation deployments.
This action type can be used to add a constant value or the value of an event attribute (such as Target
IP or Initiator User Name) to an existing dynamic list. Any values that are repeated across multiple
events are only added to the dynamic list once. The various parameters available are:
Parameters
Table 4-5
Option
Element Values
Element Type
Dynamic List Name
Attribute Names
If there are entries for both Element Values and Attribute Names, both are added to the dynamic list
when the rule fires. If the Element Value is filled in and the Element Type is Transient, the time
stamp for the element in the dynamic list is updated each time the rule fires.
104 Sentinel 6.1 Rapid Deployment User Guide
Adding to a Dynamic List
Function
(Optional) Specify a constant value to add to the dynamic list. If this is
blank, Attribute Name must be populated.
Persistent or Transient.
Select an existing dynamic list from the drop-down menu.
(Optional) For every event that is part of a correlated event, the value
or values of the selected event attribute are added to the dynamic list.
If this is blank, element values must be populated.