Lists
- A list is a set of field values which can be used as parameters in event queries and correlation rules. cWatch features three type of lists, 'Live Lists', 'Range Lists' and 'IP Range Lists'.
- 'Live Lists' specify a single value.
- 'Range Lists' specify a range of values (e.g. port numbers).
- 'IP Range Lists' specify a range of IPs.
- Any updates to a list are dynamically reflected in all queries and rules in which they are used.
- Lists are created by first specifying the event field then populating it with values.
- Live Lists can be populated by entering values manually or by configuring correlation rules to feed values automatically from events. See List Mappings in 'Manage Correlation Rules' for more details.
- Values for range lists and IP range lists have to be entered manually.
See the following sections for more details: