Lookup tables
Lookup tables are extension for parsing rules, which contain lists of extensions. If, for example, protocol number appears in incoming messages, you can define a list of protocol numbers and their text names (e.g. protocol 443 = HTTPS) with this function. Text name is automatically added to the message and saved in the system.
This feature is used with the Lookup table search block. This block includes a list of all lookup tables, which can be used to complete information in a message.
If multicolumn lookup is enabled, it will search for first column and return list of values in remaining columns.

Lookup tables
Tables list shows all records, defined in the system. Table shows basic information: Name (name of the lookup table), Description (description of the lookup table) and Built in (whether the lookup table is integrated in the system).
Filter fields are located above the table. Data may be filtered by any single column. In case of using filters above more columns, the AND term is applied.
If you need to add a new lookup table, click the green plus icon in the main table in the upper right corner.

Adding a lookup table
Enter following data into the prepared form:
-
Name of the parsing rule,
-
Description of the parsing rule,
-
Content - list of values specified in CSV format RFC4180, for each row is one rule in format “original_text;append_text”.
For example:
1,ICMP 2,IGMP 3,GGP 4,IPv4
Link to RFC format of CSV: https://tools.ietf.org/html/rfc4180
Recommended to use a tool, such as Excel, to generate the CSV format.
Editing of the lookup table can be started by clicking the blue pencil icon, which is shown by every row. Integrated lookup tables cannot be edited nor deleted.

Editing a lookup table
Form identical to the form for adding of a new lookup table is now shown.
Deletion of a lookup table is done by clicking the red cross icon, which is shown by every row.

Deleting a lookup table