Creating Local Variables

Click the Local Variables tab to manage local variables for this profile. These variables are available from the drop-down menu on the Attributes tab for event fields, source, and target attributes associated with the pattern.

From this tab you can:

• Add a variable.

  Note: Variable names must be unique across resources. Local variables cannot share names.

• Edit a variable.

• Remove a variable.

• Make a variable global, which means it is available to resources outside this profile. If you make a local variable global, it moves it from the Local Variables tab to the Fields and Global Variables tab in the drop-down menu on the Attributes tab for event fields, source, and target attributes associated with the pattern. .

  For more information on using local and global variables, see Variables.

Threat Detector supports the following variable return data types:

• Byte
• Double
• Enumeration
• Integer
• Long
• Resource ID
• String
• Address

Therefore, function variables that return an unsupported data type are not supported. For example, the following functions or function categories are not supported:

• Non-SQL-mode variables

• Variables that return a list, such as ActorByAccountID.AccountID and variables that operate on multi-mapped active lists or overlapping session lists

• Variables that return a boolean value, such as the Category Model function hasRelationship