Dynamic lists

[RSAAdmin]

Hi all, I need to use dynamic lists (like active lists in ArcSight) to use them on correlation alerts. I cannot modify watchlists as an output action, so I do not know how to do it. This kind of lists could be useful for monitoring. For example, if I want to know which users are currently logged in or which machines are currently updated. Does somebody try to define these correlation rules? Thank you. Best regards!

[ScottPause]

Getting output of alerts (like source IP) - not possible.  You could use task escalate, but that would be difficult (although possible).

For general watchlist updating:

You need to use the OS and db scripts to do this.  There is a batch file included with enVision ( I think) that can update it.  There is also a powershell that can perform the same thing.

It will take the contents of a file and import it into a watchlist (overwriting it)

db_updatewatchlist

I'm looking for the ps1 script now. -> http://rsaenvision.lithium.com/t5/Tools-and-Scripts/dbUpdate-watchlist-cmd-replacement/m-p/2339