The Add/Remove from List dialog allows you to add or remove an entity or meta value to an existing list or create a new list. For example, when you look up an IP address and you find it suspicious or interesting, you can add it to a relevant list, which has been added a data source. This improves the visibility of the suspicious IP addresses. You can also add entities or meta values to different lists. For example, you can add them to one list for suspected domains related to command and control connections and to another list for Trojan connections IP addresses related to remote access. If a list is not available, you can create a list. You can also remove the entity or meta value from a list.
What do you want to do?
|Role||I want to ...||Show me how|
|Incident Responders, Analysts||Add an entity to a list.|| |
From the Incident Details view, see Add an Entity to a Whitelist.
From the Alert Details view, Add an Entity to a Whitelist.
Incident Responders, Analysts
|Create a whitelist, blacklist, or other list.||Create a List|
Add a Context Hub list as a data source.
See "Configure Lists as a Data Source" in the Context Hub Configuration Guide.
|Administrators||Import or export a list for Context Hub.||See "Import or Export Lists for Context Hub" in the Context Hub Configuration Guide.|
- Investigate the Incident
- Reviewing Alerts
- View Contextual Information (Incident Details view)
- View Contextual Information (Alert Details view)
|1||Entities or meta values to be added or removed.|
|2||Create a new list using the selected meta values.|
|3||Select any of the tabs: All, Selected, or Unselected.|
|4||Search using the list name or description.|
|5||Cancel the action.|
|6||Save to update lists or create a new list.|
To access the Add/Remove from List dialog, in the Incident Details view or the Alert Details view, hover over the underlined entity that you would like to add or remove from a Context Hub list. A context tooltip appears showing the available actions.
In the Actions section of the tooltip, click Add/Remove from List. The Add/Remove From List dialog shows the available lists.
The following table shows the options in the Add/Remove from List dialog.
|Meta Value||Displays the selected entity or meta value that needs to be added to or removed from one or more lists. You can also a create a new list using the selected value.|
|Create New List||When clicked, it displays a dialog to create a new list using the selected meta value.|
|All||Shows all of the available Context Hub lists. The lists that contain the selected entity or meta value are selected. Select a checkbox to add an entity or meta value to a list. Clear a checkbox to remove it from the list.|
|Selected||Shows only the lists that contain the selected entity or meta value. (All lists are selected.)|
|Unselected||Shows only the lists that do not contain the selected entity or meta value. (All lists are unselected.)|
|Filter Results||Enter the name or description of a specific list to search from multiple lists.|
|List||Displays the name of all the lists.|
|Description||Displays information about the selected list. The description that you provide when creating a list appears in this dialog. For example: This list contains all of the blacklisted IP addresses.|
|Cancel||Cancels the operation.|
|Save||Saves the changes.|