Static lists are lists that do not depend on any condition in which companies determine their inventories such as Administrator Users, Branch Networks, NAC Servers etc. You can use these lists for exclude and include parameters when creating correlation rules.
To create a static list, go to Settings › Alerts & Incidents › Buckets and click + Bucket. The Add List page opens.
Static list allows you to fill list by values you want matches. When Logsign Unified SecOps Platform detects your keys of the list in the logs, You can use this keys of the list for alert behaviour option.
The Definition section contains the following fields:
Description: In terms of definition, you need to specify a name for the list. This field is required and accepts letters, digits, spaces and the characters _ . - /
Type: Static
Group: Required. Select the group the list belongs to: Behaviour, Intelligence, Asset or Other.
Severity: You can decide with this severity selection how much important the list for you. The options are Emergency, Critical, Warning and Information.
Context: You can tag the object, which enters this list, as Suspicious, Attacker, Victim or Vulnerability for future events. Leave it as Not Set if you do not want to assign a context.
Tags: Optional. You can assign one or more tags to the list.
Roles: Optional. You can select one or more roles for the list.
Match Type: You can select which type of data stores in the list, these types are. After you add the first value, the other match types are disabled, so a list holds a single type of data.
Static Key: You can add any string value into your list. Enter it in the Key field.
Contains Any: You can add any partial string value into your list. Enter the values in the Contains box, one per line.
IP - Network: You can add any IP or IP Range or Network Range information into your list. (IP Network Format Tips: 10.0.0.0/255.0.0.0 OR 10.0.0.0/24 OR 10.0.0.1 - 10.0.0.50)
Integer Range: You can add any Integer value into your list. Enter the start and end values in the Range field (Integer Format tips: 100 - 500)
For every match type you can also fill in the Value field. If you leave it empty, the value is set to 1. Click Add to add the entry to the table below the form.
Then use the Save button to save your settings.