About lookup tables
Lookup tables are used to correlate values in a data table with corresponding values in the lookup table. For example, a lookup table containing IP addresses with their geographical addresses may be used to add geographical addresses to a data table during a query. Therefore, lookup tables are used to enrich the information in raw data tables.
- Lookup tables must be uploaded in .csv format.
- Lookup values are added to the virtual data table at query time. The original data tables are never modified.
- A key value must be selected. This is the column in the data table that has values that correspond to values in the lookup table.
- Once uploaded to Devo, a lookup table can be edited to add, change or delete information.
The sources of lookup tables may be external or internal:
External sources include lists of values, geo-localizations, or extracts from a database. Learn here how to upload external data as a lookup table.
Internal sources based on queries whose data is used to create a lookup table. For example, robot activity logs contain data that measure the precision of the robot. The values in this table could be used in a lookup table that associates a quality rating based on measured values. Check the dynamic lookups article to learn more about this.
Apart from user-created lookup tables, Devo is pre-installed with a set of threat lookups you can use to detect IP addresses or domains related to potential fraud or malware threats. See threat lookups for more information.
Here are some common use cases that demonstrate how lookup tables can be used.
Converting codes into names
- Convert an IP address into a machine name.
- Convert an IP address into a geo-localization.
Add values to classify or filter events
- Associate an IP to known threats.
- Group IP by types of devices: servers, portable computers, printers.
For example, lookup tables can be used to enrich a data table containing information about a manufacturing company's robots.
- They can associate robot IDs to factory locations.
- They can categorize types of robots but their functions.
- They can assign rankings to robots based on measurements in the data table.