To use the range map functionality, a map definition must have exactly one key column and the key column must be of type NumberRange. If there are any other key columns, or if the key column is of a different type, the mapping service does not consider the map to be a range map.
To create a range map, select a single column to be the key of the map and select NumberRange as the type of the column. The format of the data in a column of type NumberRange must be m-n, where m is the minimum number in the range and n is the maximum number in the range (that is, 10-200). The maximum number in the range is not included in the range (that is, [m,n)). This means a range of 10-200 only keys off numbers equal to 10 to 199. An example set of data is with the first column as the key:
1-2,AA 2-4,AA 4-12,BB 10-20,BB 30-31,BB 100-200,AA 110-120,CC
Figure 10 Number Range Map Definition
The example table is transformed to:
Figure 11 Table Transformation
An example event configuration on the above map might look like:
Figure 12 Event Configuration
In this example, CustomerVar97 is expected to contain a numeric value or is of a type that can be converted to a numeric value, such as an IP or Date.
When you look into the example range map, the value in CustomerVar97 takes the range map and searches for the range that the value belongs in (if any). Some examples and their results are:
CustomerVar97 = 1; CustomerVar89 will be set to AA CustomerVar97 = 4; CustomerVar89 will be set to BB CustomerVar97 = 300; CustomerVar89 will not be set
Internally, Sentinel converts IP addresses and dates to an integer for tags of the type IPv4 and Date.
IPv4 tags are:
TargetIP (dip)
InitIP (sip)
Date tags are:
CustomerVar11 to CustomerVar20 (cv11 to cv20)
DateTime (dt)
ReservedVar11 to ReservedVar20 (rv11 to rv20)
DeviceEventTime
SentinelProcessTime
BeginTime
EndTime
For more information on meta tags, see Sentinel 6.1 Rapid Deployment Event Fields
in the Sentinel 6.1 Rapid Deployment Reference Guide.
For example, for the table below, column 1 is numerical range equivalent to an IP range of 10.0.0.0 to 10.0.2.255.
167772160-167772415,AAA 167772416-167772671,BBB 167772672-167772927,CCC
Using the same setup as the previous example, if:
The Event Tag is set to TargetIP and key column set to column 1 (range)
Map Column is set to column 2 (value). The output values are for CustomerVar89.
Figure 13 Number Range Map Definition
Figure 14 Event Configuration
If an event contains a target IP of 10.0.1.14 (equivalent to a numerical value of 167772430), the output for the CustomerVar89 column within the event is BBB.
Sentinel supports the following number ranges:
Range from negative number to negative number (for example, “-234—34”)
Range from negative number to positive number (for example, “-234-34”)
Range from positive number to positive number (for example, “234-236”)
Single number range (negative) (for example, “-234”). In this case, the minimum and the maximum are both “ -234”.
Single number range (positive) (for example, “234”). In this case, the minimum and the maximum are both “234”.
Range from negative number to max number (for example, “-234-”). In this case, the minimum is “-234” and the maximum is (2^63 - 1).
Range from positive number to max number (for example, “234-”). In this case, the minimum is “234” and the maximum is (2^63 - 1).
NOTE:In all cases, the min must be less than or equal to the max (for example, “-234- -235” is not valid).
For trademark and copyright information, see Legal Notices.