In other words, what’s the best way to create a whitelist when evaluating log data?
A lookup table with inline lookup function:
C.Lookup('filename.csv','key_field').match(lookup_value)
edit: see also C.LookupCIDR()
and C.Net.cidrMatch()
5 UpGoats