Reporting: Working with Lists in the Reporting Module

Document created by RSA Information Design and Development on Sep 14, 2017Last modified by RSA Information Design and Development on Oct 15, 2017
Version 9Show Document
  • View in full screen mode

A list is a variable that refers to a series of comma-separated values (CSV).  You can insert a list into a rule or use it as an argument to a rule action. Lists can act as placeholders for other values, which you can populate and update as needed.

The Lists module is used to define, manage and view lists that can be used in defining rules for generating reports, charts and alerts. For more information, see the Lists Panel section in Build Rule View.

Note: In the User Interface (UI), the date or time displayed depends on the time zone profile selected by the user.

Lists cannot be empty or have duplicate or blank values. For example, a list can have at least one value but it cannot be blank.

Note: If you are defining a report with a rule which has lookup_and_add in the Then clause and direct the report output to a list, the list is not populated with the result.
For example, if you create a rule with ip.src in the Select clause and lookup_and_add ('ip.dst','ip.src', 10) in the Then clause, the report displays the result, but if you have redirected the output to a list, the list will be empty.

You are here
Table of Contents > Reporting: Working with Lists in the Reporting Module

Attachments

    Outcomes