Skip to main content
Version: 6.1

Active Lists

Search Anywhere Framework Streaming Correlator stores state shared between events and rules in active lists. These lists contain watchlists and accumulated attributes that rules read and populate while processing the event stream.

Active lists

List Parameters​

The active list editor contains the following parameters:

  • List Name - required field; Latin letters, digits, _, and - are allowed
  • Sources - data sources whose events populate the list
  • Enable Automatic Population - allows the list to be populated from the event stream
  • Stream Filter - a condition in the SAFL (RTC) dialect that selects events for automatic population
  • Fields - the Field button adds a field with a required Name and a Key Field toggle. For each field, you can expand Mapping, which contains Source and Source Field Name pairs used to extract the field value from an event received from the corresponding source. Add Mapping adds another pair. Key fields form a composite record key used to find and update records when another match occurs
  • Enable TTL - sets the record lifetime from the time it was last written. While the toggle is disabled, records are stored indefinitely and are removed only manually
info

A field Name must not contain . or |: those characters separate event field paths and composite record keys. A list without key fields does not update records; it appends a new one on every match.

Active list editor

Replication and Placement​

The Replication and Placement section determines which cluster nodes store the list:

  • Replicas - number of additional list copies besides the primary copy
  • Pin to Specific Nodes - enables manual placement. When disabled, placement of both the primary copy and replicas is determined automatically across all cluster nodes. When enabled, a table with the Node, Primary, and Replica columns appears. For each cluster node, the table specifies whether it is the primary (Primary) or one of the replicas (Replica) for this list

Replication and placement

Using Active Lists in Rules​

Rules access active lists through two functions in the SAFL (RTC) dialect:

  • alcontains(list, field as value) - checks whether the list contains a record whose specified field equals the specified value. Several field and value pairs may be given, in which case the record must match all of them
  • alget(list, value, field) - finds a record by key value and returns the value of the specified field of that record

For the full syntax and examples, see Condition Language Functions.

alcontains(ti_ip_blacklist, destination.ip as source.address)
alget(known_hosts, host.name, status) == "trusted"

If a rule accesses two or more active lists, those lists must share a common holder node. Until such a node exists, the rule is marked as failing and its events are not processed. The state clears automatically as soon as the list placements overlap again.