Table of Contents
Advertisement
3.6.2 Add to Dynamic List
Figure 3-3
NOTE: This type of action can only be used in Correlation deployments.
This action type can be used to add a constant value or the value of an event attribute (such as Target
IP or Initiator User Name) to an existing Dynamic List. Any values that are repeated across multiple
events are only be added to the dynamic list once. The various parameters available are:
Parameters
Table 3-4
Option
Element Values
Element Type
Dynamic List Name
Attribute Names
If there are entries for both Element Values and Attribute Names, both are added to the Dynamic
List when the rule fires. If the Element Value is filled in and the Element Type is Transient, the
timestamp for the element in the Dynamic List is updated each time the rule fires.
88
Sentinel 6.1 User Guide
Adding to Dynamic List
Function
[optional] Specify a constant value to add to the dynamic list. If this is
blank, Attribute Name must be populated.
Persistent or Transient
Select an existing Dynamic List from the dropdown menu.
[optional] For every event that is part of a correlated event, the value or
values of the selected event attribute is added to the Dynamic List. If
this is blank, Element Values must be populated.
Advertisement
Table of Contents
