List lookup check

The List lookup check policy item allows you have the policy evaluate whether the value of some selected event data is equal to a value contained in a list.

In the properties of the List lookup check policy item, you can specify a range of values in the list that the selected event data value can be matched against. It is useful in situations where you wish to configure a small range of possible values that are acceptable for this particular policy item, rather then checking against a configured global data list using the Data list lookup policy item registered by the Data module.

To use the List lookup check:

1. Create or select a policy to open a policy editor.
2. In the Items section of the policy editor toolbox, select the List lookup check policy item and drag it on to the worksheet. This will automatically open the List lookup check properties.

   

   Close | Close all images

3. Select the Insert symbol button to the right of the Check that the value of field to open up the Symbol Browser.

   

   Close | Close all images

4. Select the Symbol for the event data that you want the List lookup to check the value of. (In this example Request.Port is selected).

   Read more about using the Symbol Browser

5. Select OK to return to the List lookup check properties

   

   Close | Close all images

6. In the Matching values window, enter the required values that the selected event data has to match.

   In this example the List lookup will check the value of the Request.Port (i.e. The destination port which the client who instigated the event makes the request to) against the list of port values in the Matching values window.

7. In the Method drop down menu, select either pattern match or exact match, depending on how the values on the list should be compared.

   1. Exact match (faster)

      As the title implies, only an exact match of the data against the value on this list will be valid. This type of method is processed faster then the pattern match method.

      Note

      When the exact match method is chosen all normal punctuation marks such as a period (.) or a comma (,) are considered as part of the value to be matched. This also includes the question mark(?) and asterisk(*).

   2. Pattern match

      Pattern matching will allow you to add a value pattern to the list using the standard WinGate wildcards of ? (question mark) or *(asterisk).

      The question mark wildcard is used to indicate a match of a single character. While an asterisk allows you to widen the pattern match value further, as the match will include one or more characters from where the asterisk is placed in the value.

      Note

      When using the pattern match method against a value on the list, normal punctuation marks such as a . (period) -(hyphen) or , (comma) etc. are considered as valid characters. This however excludes the WinGate wildcards, ? (question mark) or *(asterisk).

8. Click OK to finish editing the List lookup policy item and return to the worksheet.
9. The List lookup check policy item will now blink, allowing you to enter a meaningful name so you can identify it easily in the policy flow.