Respond: Add/Remove from List Dialog

Document created by RSA Information Design and Development on Sep 14, 2017Last modified by RSA Information Design and Development on Oct 15, 2017
Version 6Show Document
  • View in full screen mode
  

The Add/Remove from List dialog allows you to add or remove an entity or meta value to an existing list or create a new list. For example, when you look up an IP address and you find it suspicious or interesting, you can add it to a relevant list, which has been added a data source. This improves the visibility of the suspicious IP addresses. You can also add entities or meta values to different lists. For example, you can add them to one list for suspected domains related to command and control connections and to another list for Trojan connections IP addresses related to remote access. If a list is not available, you can create a list. You can also remove the entity or meta value from a list.

Note: From the Add/Remove from List dialog, you can only add or remove entities or meta values from single column lists added as a datasource, not multi-column lists. And when you edit a list or a value in a list from the nodal view or the context lookup view, ensure to refresh the web page to view the updated data.

What do you want to do?

                                 
RoleI want to ...Show me how
Incident Responders, AnalystsAdd an entity to a list.

From the Incident Details view, see Add an Entity to a Whitelist.

From the Alert Details view, Add an Entity to a Whitelist.

Incident Responders, Analysts

Create a whitelist, blacklist, or other list.Create a List

Administrators

Add a Context Hub list as a data source.

See "Configure Lists as a Data Source" in the Context Hub Configuration Guide.

AdministratorsImport or export a list for Context Hub.See "Import or Export Lists for Context Hub" in the Context Hub Configuration Guide.

Related Topics

Note: You cannot delete a list, but you can delete values within a list.

Quick Look

The following is an example of the Add/Remove from List dialog in the Respond view.
Add/Remove from List Dialog

                             
1Entities or meta values to be added or removed.
2Create a new list using the selected meta.
3Select any of the tabs: All, Selected, or Unselected.
4Search using the list name or description.
5Cancel the action.
6Save to update lists or create a new list.

Add/Remove from List

To access the Add/Remove from List dialog, in the Incident Details view or the Alert Details view, hover over the underlined entity that you would like to add or remove from a Context Hub list. A context tooltip appears showing the available actions.

Context tooltip example

In the Actions section of the tooltip, click Add/Remove from List. The Add/Remove From List dialog shows the available lists.

Add/Remove From List dialog example

The following table shows the options in the Add/Remove from List dialog.

                                                   
OptionDescription
META VALUEDisplays the selected entity or meta value that needs to be added to or removed from one or more lists. You can also a create a new list using the selected value.
Create New ListWhen clicked, it displays a dialog to create a new list using the selected meta value.
ALLShows all of the available Context Hub lists. The lists that contain the selected entity or meta value are selected. Select a checkbox to add an entity or meta value to a list. Clear a checkbox to remove it from the list.
SELECTEDShows only the lists that contain the selected entity or meta value. (All lists are selected.)

UNSELECTED

 

Shows only the lists that do not contain the selected entity or meta value. (All lists are unselected.)
Filter ResultsEnter the name or description of a specific list to search from multiple lists.

LIST

Displays the name of all the lists.

DESCRIPTIONDisplays information about the selected list. The description that you provide when creating a list appears in this dialog. For example: This list contains all of the blacklisted IP addresses.

Cancel

Cancels the operation.

SaveSaves the changes.
Previous Topic:Tasks List View
You are here
Table of Contents > NetWitness Respond Reference Information > Add/Remove From List Dialog

Attachments

    Outcomes