Hi! I like to enrichment a List (Create a Blacklist) using a rule, when an IP do a specific behavior add to a list, I try put something like this in the end of the rule, but don't work:
insert into BlackList
select ip_src;
I "call" the list in the beginning of the rule @UsesEnrichment(name="BlackList"),
Any suggestions?
In case of RE you have to use the Dynamic list feature to update the list values. You can overwrite a list or append the values. Refer the details how to update the list values based on the rule you define below. Also, if you want the values to be updated at regular frequency then schedule a report using this rule and the list values will keep on updating based on what it matches the rule.
https://community.rsa.com/docs/DOC-84091