Create Lists in the Client Console
Lists are comprised of items or other lists.
- On the main toolbar, click List Manager.
- On the File menu, click New.
The New List dialog box appears. - Select a list type, and then click OK.
The New (List Type) List Properties window appears. - On the Basic Configuration tab, complete the following fields to identify the list:
- Name. Enter a name for the list.
- Brief Description. (Optional) Enter a description for the list.
- Set the permissions for the list by selecting the appropriate options from the lists in the Permissions section.
Read Access. Read Access permissions override Write Access permissions. For example, if Read Access permissions are set to Private, Write Access permissions cannot be set to anything other than Private. In addition, Read permissions have to be less restrictive than Write Permissions. Read permissions cannot be set to Private if Write permissions are set to Public All. Grant read access to the list by selecting one of the following options.
Read Access Description Public Global Administrator Grants read access to Global Administrators. Public Global Analyst Grants read access to Global Analysts. Public Restricted Admin Grants read access to Restricted Administrators Public Restricted Analyst Grants read access to Restricted Analysts. Public All Users Grants read access to all users. Private Grants read access only to the owner of the list. Write Access. Write Access options vary with the level of Read Access you selected. Grant write access by selecting one of the following options.
Write Access Description Public Global Administrator Grants write access to Global Administrators. Public Global Analyst Grants write access to Global Analysts. Public Restricted Admin Grants write access to Restricted Administrators Public Restricted Analyst Grants write access to Restricted Analysts. Public All Users Grants write access to all users. Private Grants write access only to the owner of the list. - Owner. This field is disabled. It shows the owner of the list.
- Default Entity. This field displays the entity with which the list is associated. To change the Default Entity, click the search icon at the end of the field and select an entity from the Entity Selector window.
- Restricted Read. Restricted Read is used to prevent users who do not have Write Permissions to the list from viewing the items on the list. Selecting a Read Access value other than Private enables the Restricted Read check box.
- Configure the Auto Import settings. Auto Import is only available for the following types of lists: Domain Impacted, General Value, Host, IP Address, IP Range, and User.
- Enable. Select to enable Auto Import.
- Replace existing items. Select to replace the existing list values. This does not remove any existing lists, only the values.
- Import items as patterns. Select if your imported list contains values with wildcard patterns. Otherwise, wildcard characters will be treated literally.
- File name. The default import directory is config\list_import.
(Optional) To give the items in the list an expiration date, select the Expiring Items check box. Configure the expiration settings.
If you select the Expiring Items check box, all List items you add will have an expiration date. To add some list items without an expiration date, clear the Expiring Items check box, add list items, save the list, and close the window. Then modify the list following the steps in Add Expiring Items to a List.
- Click the List Items tab.
Do one of the following:
Add an Item.
Click Add Item.
The appropriate selector box appears, based on the selected list type.Select the items or lists to include in the list being created.
Add a List.
Click Add List.
The appropriate list selector box appears, based on the selected list type.Select the items or lists to include in the list being created.
When adding a related list, only lists that are compatible with the current list are shown. Each list type allows lists of the same type to be added as a related list.
Host lists allow you to add General Value, IP Address, and IP Range lists in the Related Lists section.
User lists allow you to add General Value lists in the Related Lists section.
Items and lists that are added appear in the text box. The Lists appear with an icon as shown.
Import a list.
Click Import items on the bottom of the window. Not all List Types can import values. The following can import values:
General Value
Host
Users
It is not possible to specify a sub list via Import, but Imported lists may contain sub lists (only items are affected by the import process).
- Select the Import behavior from the following:
- Replace existing items (lists are not removed). Select this option to replace existing list values. This does not remove any existing lists, only values.
Import items as patterns. Select this option to have the list items treated as wildcards instead of literal values. When this option is selected, each list item is wrapped in percent (%) signs. The default (off) is to treat all input as literal values, with no patterns or escaping. Turning the option on enables Pattern characters, in which case all pattern-literals need to be escaped. The following table indicates how values are interpreted. Where multiple types are supported, the type is determined in the indicated priority order.
List/Entry Type Examples Comments Host/IPv6 Range fe80::1~fe80::
ffff ::~::1
Contains tilde and both parts meet valid IPv6 format, including dotted decimal-suffix. Host/IPv4 Range 192.168.1.1~192.168.1.255 Contains tilde and both parts meet valid IPv4 format. Otherwise, an error is raised. Host/IPv6 fe80::1
::1
Contains two colons. Any valid IPv6 format, including dotted decimal-suffix. Otherwise, an error is raised. Host/IPv4 192.168.1.1 Meets valid IPv4 format. Host/Hostname gandalf
Should use valid hostname characters plus wildcards (if enabled), but these are not verified.
Hostnames may start with a leading digit per RFC 1123.
Hostnames with a space are not supported.
Host/Known Host n/a Not supported. General Value (all contexts) confidential http://www.facebook.com dearest% Valid text plus wildcards (if enabled). User joe
joe.user
john%
john\%
Valid text plus wildcards (if enabled).
Active Directory Groups are not supported.
Do not put AD Groups in import lists, because they will be deleted. Use a sub list to hold AD Groups.
Click an Import format from the following:
Import Text File. To import a text file, click Import Text File, go to the file, and then click Open.
Import Clipboard Text. To import a list from the clipboard, ensure you have already copied the values you want to import, and then click Import Clipboard Text. This pastes the values into the List Items tab.
- Up to 2 million items can be imported. However, only 30,000 items can be edited in the interface.
- Items in a list that are going to be imported must be separated with a comma (,) or line breaks. Leading/trailing spaces are removed.
- No validation is done on the contents of a file or the clipboard. They are both treated as if they were text. The items are imported as if the user had added them manually using repeated Add Item operations. The Items list is left in an uncommitted state, so you can preview the result and choose either Apply or Cancel.
- Can be ANSI or UTF. If the file has a UTF byte mark header, it is interpreted as UTF. Otherwise, it is interpreted as Extended ASCII.
- Only extended ASCII (not Unicode) characters are officially supported in LogRhythm.
- Simple textual file of line-break-separated list items. All three line-break formats are supported (CR, LF, CRLF).
- Final item does not need to be terminated.
- Empty items are ignored (that is, two or more successive line breaks.)
- Empty files are legal (removes all items.)
To bind the selected items or lists to the new list, click Apply.
Click the Additional Settings tab.
The Additional Settings tab of the List Properties dialog box is optional for all but General Value lists. It includes fields for Use Contexts and Additional Details. The Use Contexts box displays items for General Values Lists. For all other list types, the Use Contexts box is empty and disabled.
- Select at least one Use Context option.
- (Optional) In the Additional Details box, enter a long description for the list.
To save the new list, click OK.
