Don't have "sse_host_to_country" AND "gdpr_user_category" lookup file in search

[zksvc]

Hi Community,

I got trouble when want to activate Use Case "User Login to Unauthorized Geo" it said Error because it said i don't have "sse_host_to_country" and "gdpr_user_category" lookup data. 

In this case im using ES Content Updates v 4.0.0 but i have my labs with ES Content Updates 4.38.0 but when i check it it don't have any sse_host_to_country OR gdpr_user_category lookup files. Already searching it in google and i don't have any answer. Maybe this community have enough experience about this. 

Thanks 

[PickleRick]

These are lookups you should have defined based on your own environment (probably populated by user/asset management). The idea here is that you want to find if someone from - for example - US branch of your company doesn't log to Germany-based servers. And how anyone except you should know which hosts are in Germany and which users work in US?

[zksvc]

Could you please give me Format that lookup ? 

[PickleRick]

You can infer from the search itself which fields you need present. You need "dest" and "country" fields in the sse_host_to_country lookup and "user" and "countries" fields in the gdpr_user_category lookup (and the "countries" field can contain multiple values separated with the pipe character).

[zksvc · Accepted solution]

Thankyou for your information, so i create that csv like this for sse_host_to_country :
host,country
host1.example.com,Japan
host2.example.com,Malaysia
host3.example.net,Australia
host4.example.org,Singapore

And this for gdpr_user_category :

user,category
user1@example.com,User
user2@example.com,Admin
user3@example.com,PowerUser
user4@example.com,User

[zksvc]

Anyone here ?