Using Lists into ESA Rules

[AlexeyFedorov]

Hello,

Can I use List from Reporting module into ESA Rules?

For example I have few ESA Rules where I filter many source IP addresses. I want to create one List and use it List into all my ESA Rules. Can I do it? How?

[SravanKoneti1]

Hi Alexey,

You can try In-Memory Table as Enrichment Sources In ESA. https://community.rsa.com/docs/DOC-84168 

[AlexeyFedorov]

Hello Sravan,

Could you provide an example how should it looks for exclude 10 Source IP from ESA Rule?

[BijuVasudevan]

Alexey,

You can use context hub list in ESA rule from 11.1 release onwards. Refer details listed here how to define and use in ESA rule,

https://community.rsa.com/docs/DOC-85972