#each collumn seperate with '\t' #id (0~65535) #name string #type one of ip,expr,expr_plus,digest,intval,compile or plugin #src_charset one of GBK,BIG5,UNICODE,UTF8 #dst_charset combined by GBK,BIG5,UNICODE,UTF8,seperate with '/' #do_merege yes or no #cross cache 0~max #quickswitch quickon or quick off #id name type src_charset dst_charset do_merge cross_cache quickswitch 0 TSG_SECURITY_COMPILE compile escape -- 1 GROUP_COMPILE_RELATION group2compile -- 2 GROUP_GROUP_RELATION group2group -- 3 TSG_OBJ_IP_ADDR ip_plus UTF8 UTF8 no 0 4 TSG_OBJ_SUBSCRIBER_ID expr UTF8 UTF8 yes 0 5 TSG_OBJ_ACCOUNT expr UTF8 UTF8 yes 0 6 TSG_OBJ_URL expr UTF8 UTF8/GBK yes 0 7 TSG_OBJ_FQDN expr UTF8 UTF8 yes 0 #7 TSG_OBJ_FQDN_CAT expr UTF8 UTF8 yes 0 8 TSG_OBJ_KEYWORDS expr UTF8 UTF8/GBK yes 0 9 TSG_OBJ_APP_ID expr UTF8 UTF8 yes 0 10 TSG_OBJ_HTTP_SIGNATURE expr_plus UTF8 UTF8/GBK yes 0 11 TSG_FIELD_HTTP_HOST virtual TSG_OBJ_FQDN -- 12 TSG_FIELD_HTTP_URL virtual TSG_OBJ_URL -- 13 TSG_FIELD_HTTP_REQ_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- 14 TSG_FIELD_HTTP_RES_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- 15 TSG_FIELD_HTTP_REQ_CONTENT virtual TSG_OBJ_KEYWORDS -- 16 TSG_FIELD_HTTP_RES_CONTENT virtual TSG_OBJ_KEYWORDS -- 17 TSG_FIELD_SSL_SNI virtual TSG_OBJ_FQDN -- 18 TSG_FIELD_SSL_CN virtual TSG_OBJ_FQDN -- 19 TSG_FIELD_SSL_SAN virtual TSG_OBJ_FQDN -- 20 TSG_FIELD_DNS_QNAME virtual TSG_OBJ_FQDN -- 21 TSG_FIELD_MAIL_ACCOUNT virtual TSG_OBJ_ACCOUNT -- 22 TSG_FIELD_MAIL_FROM virtual TSG_OBJ_ACCOUNT -- 23 TSG_FIELD_MAIL_TO virtual TSG_OBJ_ACCOUNT -- 24 TSG_FIELD_MAIL_SUBJECT virtual TSG_OBJ_KEYWORDS -- 25 TSG_FIELD_MAIL_CONTENT virtual TSG_OBJ_KEYWORDS -- 26 TSG_FIELD_MAIL_ATT_NAME virtual TSG_OBJ_KEYWORDS -- 27 TSG_FIELD_MAIL_ATT_CONTENT virtual TSG_OBJ_KEYWORDS -- 28 TSG_FIELD_FTP_URI virtual TSG_OBJ_URL -- 29 TSG_FIELD_FTP_CONTENT virtual TSG_OBJ_KEYWORDS -- 30 TSG_FIELD_FTP_ACCOUNT virtual TSG_OBJ_ACCOUNT -- 31 TSG_SECURITY_SOURCE_ADDR virtual TSG_OBJ_IP_ADDR -- 32 TSG_SECURITY_DESTINATION_ADDR virtual TSG_OBJ_IP_ADDR -- 33 TSG_SECURITY_ADDR composition {"source":"TSG_SECURITY_SOURCE_ADDR","destination":"TSG_SECURITY_DESTINATION_ADDR"} 34 TSG_IP_ASN_BUILT_IN ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} 35 TSG_IP_ASN_USER_DEFINED ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} 36 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} 37 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} 38 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0 39 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER -- 40 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER -- 41 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0 42 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION -- 43 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION --