USM Anywhere enables you to create correlation lists. Use a correlation list to group values together to apply to a single rule. So instead of creating a rule for each value, you can save time and effort by creating a correlation list and using it in a rule.
When creating correlation lists for rules, you can use a standard field, such as event_name
or event_description
. A helpful use for correlation lists is the creation of user blacklist, whitelists, or both, like event_names
. Or you can enter anything you want in the items of the correlation lists, but only up to 500 characters per item. There is a limit of 1000 items per correlation list.
To see an example of an alarm rule using a correlation list, see Example: Creating an Alarm Rule Using a Correlation List.
To create a correlation list
-
Go to Settings > Rules > Correlation Lists.
-
Click New List.
- Enter a name for the correlation list in the Name field and, if desired, a description to clarify its use in the Description field.
- Click Add Item to include items in your list.
- Click Save.
Important: The valid characters for the correlation list name are uppercase letters (A–Z), lowercase letters (a–z), numerical digits (0–9), and underscore (_). You can enter up to 64 characters.
Important: The list items are restricted to a string format to match the formats of the tested event detail items.
To add a new item to a list
- Go to Settings > Rules > Correlation Lists.
- Click the list to expand the details of the list.
-
Click Add Item.
The Add Item dialog box opens.
- Enter the value and click Save.
To modify a correlation list
- Go to Settings > Rules > Correlation Lists.
-
Click the
icon of the list you want to modify.
- Modify the data of the items that need to be modified.
- Click Save.
To delete a correlation list
- Go to Settings > Rules > Correlation Lists.
-
Click the
icon of the list you want to delete.
The delete dialog box opens.
- Click Delete.
To modify an item of a list
- Go to Settings > Rules > Correlation Lists.
- Click the list to expand the details of the list.
-
Click the
icon of the item you want to modify.
- Modify the item and click the
icon.
To delete an item of a list
- Go to Settings > Rules > Correlation Lists.
- Click the list to expand the details of the list.
- Click the
icon of the item you want to delete.