A State Tracker list collects the values of one or more columns from matching logs, keeps them under a key column, and uses enrichment methods such as modifiers to write that information into other logs.
State Tracker lists are created under Settings › Alerts & Incidents › Buckets. Click + Bucket and select State Tracker in the Type field.
In the example above, IP and MAC information is collected from DHCP server logs. In firewall logs the IP column is matched against the list and a Source.MacAddress column is created, so the firewall logs are automatically enriched with the MAC address obtained from the DHCP server.
Description: The name of the list. It is required and accepts letters, digits, spaces and the characters _ . - /.
Type: State Tracker
Group: The group the list belongs to: Behaviour, Intelligence, Asset or Other. It is required.
Severity: The importance of the list: Emergency, Critical, Warning or Information.
Context: You can tag the object that enters this list as Suspicious, Attacker, Victim or Vulnerability for future events. Leave it as Not Set if no context is needed.
Tags and Roles: Optional. Tags and roles assigned to the list.
Entry Conditions: The condition that adds logs to the list for enrichment (the DHCP source in the example). It is required.
Exit Conditions: The condition that removes an entry from the list. It is optional.
Collect Columns and Key Column: Select the columns whose values will be stored in Collect Columns, select the column that will be used as the key in Key Column, and click Add. At least one Collect Columns / Key Column pair is required.
Purge Period: The number of seconds an entry stays in the list after it was first added. When the period expires the entry is removed from the list. The default value is 3600 seconds.
Each time an entry is added to or removed from a State Tracker list, Logsign Unified SecOps Platform generates a Bucket Set or Bucket Unset event. The reason for the removal (Exit Condition or Purge) is written to the Event.Reason column.
The Modifier section defines how the collected information is written to other logs:
Match Conditions: The logs to which this enrichment will be applied.
Key Field: The log column whose value is looked up in the list. It should hold the same kind of value as the Key Column. Optionally, select other lists to search in, then enter the column to be written (Modify Field) and its value, and click Add.
Then use the Save button to save settings.