Types Of Reference Data Collections

Reference set

A collection of unique values, in no particular order.

Create a reference set by using JSA, the command line, or the RESTful API.

Use a reference set to compare a property value against a list, such as IP addresses or user names.

For example, you can verify whether the LoginID that was used to log in is assigned to a user.

Reference map

A collection of data that maps a unique key to a value.

Create a reference map by using the command line, or the RESTful API.

Use a reference map to verify a unique combination of two property values.

For example, to correlate user activity on your network, you can create a reference map that uses the LoginID parameter as a key, and the Username as a value.

Reference map of sets

A collection of data that maps a key to multiple values. Every key is unique and maps to one reference set.

Create a reference map of sets by using the command line, or the RESTful API.

Use a reference map of sets to verify a combination of two property values against a list.

For example, to test for authorized access to a patent, you can create a map of sets that uses a custom event property for Patent ID as the key, and the Username parameter as the value. Use the map of sets to populate a list of authorized users.

Reference map of maps

A collection of data that maps one key to another key, which is then mapped to a single value. Every key is unique and maps to one reference map.

Create a reference map of maps by using the command line, or the RESTful API.

Use a reference map of maps to verify a combination of three property values.

For example, to test for network bandwidth violations, you can create a map of maps that uses the Source IP parameter as the first key, the Application parameter as the second key, and the Total Bytes parameter as the value.

Reference table

Similar to a map of maps, but the second key is assigned a data type.

Create a reference table by using the command line, or the RESTful API.

Use a reference table to verify a combination of three property values, when one of the properties is a specific data type.

For example, you can create a reference table that stores Username as the first key, Source IP as the second key with an assigned cidr data type, and Source Port as the value.