When working in Investigate, you may find an IP address or user name that you want to watch in the Navigate view or the Events view. In the Add/Remove from List dialog, you can add meta values for the Source IP, Destination IP, or Username meta keys to an existing context hub list or you can create a new list containing the meta values. When you add meta values to a list, you can look up additional context on those meta values.
To display the dialog. right-click a meta value under Source IP, Destination IP, or Username) and select Add/Remove from List in the context menu.
The following workflow diagram shows the high-level workflow for Investigate with the location of the Add to List task highlighted.
What do you want to do?
The following figure shows the dialog when you select Create New List.
The following table describes the features of Add/Remove from List and Create New List dialogs.