Creating an Enrichment List

A user with admin access can create a configuration file that includes a list of keywords or phrases that need to be searched often.

1. Create an enrichment list configuration file and specify the following information:
   • Name: The name can include letters, numbers, or underscore (_).
   • Description
   • Value Type
   • Mappings
   A single Enrichment List can include key-value mappings for different types of information. A sample file is as follows:

   {
      "smartlists": [
         {
            "name": "test123",
            "valueType": "string",
            "description": "test123",
            "mappings": {
               "10.97.170.168": "blacklistIP",
               "10.97.170.175": "blacklistIP",
               "node1": "nodeName",
               "5": "reserved"
             }
         },
      {
           "name": "test234",
           "valueType": "string",
           "description": "test234",
           "mappings": {
                 "key2": "value2",
                 "key3": "value3"
             }
     }
    ]
   }

2. Save your file using the following naming convention: <filename>.conf.
3. To activate the file, run the following command from the folder in which the file is stored:

   llconf import -f <filename>.conf

   Note: If your file is saved in any other folder, you must specify the full path of the file in the command:

   llconf import -f <full_path_of_filename>.conf

1. Navigate to Management > Advanced Features > Enrichment Lists.
2. Click to add a new list.
3. In the Add Enrichment Lists dialog box, specify the following fields for the enrichment list:
   • Name: The name can include letters, numbers, or underscore (_).
   • Description
   • Value Type
   • Mappings
   
4. Click Save.

Result

The Enrichment List is displayed on the page.

If the mappings section contains the key default and there is no other mapping for the key used during lookup, the mapped value is returned as a default value. To override this default value at query time, specify the optional <default_value> parameter as a second parameter.

Note: Clicking any Enrichment List name in the list displays its information in a separate Details pane.