Configure watchlists

Create watchlists that trigger alarms, correlation rules, filter views, or reports.

Using GTI Malicious IPs and GTI Suspicious IPs values in watchlists requires a Trellix GTI license.

Important

These characters are not allowed in watchlist names and fields: &, <, >, %, ".

Select Watchlists from the navigation menu.
Click Add or Edit.
Expand Main.
Note
Both static and dynamic watchlists are limited to a maximum number of 1,000,000 values. The system can display up to 1,000 imported values and indicates that not all imported values are displayed.
- Name the watchlist and indicate whether it is a static or dynamic watchlist. Do not use quote marks, ampersand, or parentheses in watchlist names: ' " & ( ).
- Static watchlists contain values (imported or entered manually) that don't change over time.
  You can set when static values expire (between 1 hour - 365 days). Each value is time stamped and expires when the specified duration is reached, unless it refreshes. When that duration passes, the system deletes the watchlist value. Watchlist values can refresh if an alarm triggers and adds those values to the watchlist.
- Dynamic watchlists contain values that change automatically, through queries, regular expressions, or string search criteria.
  - You can specify when to update dynamic values automatically. The system queries the source (using the data given) and refreshes the values at the specified time.
  - Select the source to populate dynamic values. Source fields vary depending on which type you select.
Expand Source (watchlist types):
- Static watchlists:
  - Import a file of values in new-line-separated format.
  - Type the values, one value per line (up to 1000 values).
  - Trellix GTI — You can't view or edit Trellix GTI watchlists, but the watchlists indicate whether they are active (contain values) or inactive (do not contain values). Use Trellix GTI watchlists to trigger alarms; filter reports, views, or correlation rules; or use as a scoring source for risk correlation managers on your Trellix ESM - ACE devices.
    Note
    Using Trellix GTI watchlists requires a Trellix GTI license. Downloading lists can take several hours and requires an Internet connection (they can't be downloaded offline).
- Dynamic watchlists — fields vary depending on the type of watchlist:
  - Dynamic watchlists are populated with values returned by the regular expression you write. Enter a regular expression or search criteria for strings found in events or rule messages, which contain the rule's short descriptions. Searches are case sensitive by default. To perform a case-insensitive search, surround search strings or regular expression with forward slashes followed by i, such as /Exploit/i.
    Strings — The watchlist contains a list of string-type-custom-type strings (compiled from Events) that match the regular expression.
    Rule names — The watchlist contains a list of Trellix ESM rule names that match the regular expression.
  - HTTP/HTTPS — Use this dynamic watchlist to pull threat or Indicators of Compromise (IOC) feeds from the internet. You can preview the data through the HTTP request, and filter the data using regular expressions.
    Preview the first 200 lines of the website source code, which you can use to write a regular expression search. A Run Now or scheduled update of the watchlist includes all matches from your regular expression search.
    Note
    This option supports RE2 syntax regular expressions, such as (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) to match on an IP address.
    Authentication — Select Basic if the website requires a user name and password to log on. Default setting is None.
    Ignore Invalid Certificates — To search a website with an https URL, select this option to ignore invalid SSL certificates.
    Method — To search a website that requires a post content or argument, select POST. Default setting is GET.
    Specify how many header lines of code to skip in your website search.
    Type the character the website uses to separate values. This default is \n, which indicates that a new line is the delimiter. The other most common delimiter is a comma (,).
    Type a regular expression that removes unwanted values from the results of your regular expression search.
    (Required) Type the logic used to find a match and extract the values from the site. Use this to create an expression that matches on a list of known malicious IP addresses or MD5 sums listed on a site.
  - TrellixActive Response — populates dynamic watchlist values with data you specify.
    Note
    If Trellix ESM fails to pull Active Response collectors over DXL, the Active Response type is not listed.
    Collector — Select the collector that you want to use to pull data.
    Value — Select the column of retrieved data that you want to include in the watchlist.
    Or or And — If you have two or more filters, select whether to apply all filters to the data (using And) or to apply either of the filters (using Or).
    Filters — Select the filters to apply to the search.
    Add Filter — You can select a maximum of 5 filters.
  Note
  More types of watchlists are supported (such as CIFS, FTP).
Expand Values.
- Select a type that assigns the search results to a field type. This choice allows the system to use the watchlist to filter views and reports or to trigger alarms and correlation rules. You can change this setting on existing watchlists.
  If the watchlist has less than 25,000 values, Trellix ESM validates that the old and new types are compatible and returns an error if they aren't.
  If the watchlist has more than 25,000 values, you must validate compatibility.
  Note
  If this is a dynamic watchlist and you select String as the source, the application does not filter the search by the type you select. Instead, the search returns all matching strings.
- For a dynamic watchlist, the values table fills with values every time a search runs. If the watchlist has more than 25,000 values, the Values field states that there are more values than can be displayed.
- User name identifies who can access the database. For LDAP, the user name must be a fully qualified domain name without spaces, such as:
```
uid=bob,ou=Users,dc=example,dc=com 
```
  or
```
administrator@company.com
```
Save your changes.
Important
A database sync is needed before watchlists begin functioning. Wait 15 minutes to check for expected results.