# Lookup Table Specification Reference

The following is a complete list of Lookup Table specification fields. Field names in bold are required. An asterisk (`*`) indicates that 2 fields are mutually exclusive.

| Field Name         | Description                                                                       | Expected Value    |
| ------------------ | --------------------------------------------------------------------------------- | ----------------- |
| **`AnalysisType`** | Indicates that this is a Lookup Table                                             | `lookup_table`    |
| **`Enabled`**      | Whether this table is enabled                                                     | Boolean           |
| **`LookupName`**   | The unique identifier of the table                                                | String            |
| **`Schema`**       | The ID of the schema to use for parsing input data                                | String            |
| **`LogTypeMap`**   | A mapping of log schema fields to match against this table                        | Object, see below |
| **`Filename*`**    | The relative path to the data file. **Cannot be used with Refresh!**              | String            |
| **`Refresh*`**     | The configuration of the S3 Sync functionality. **Cannot be used with Filename!** | Object, see below |
| `Description`      | A breif description of the table                                                  | String            |
| `Reference`        | An optional reference link                                                        | String            |

#### LogTypeMap Specification

`LogTypeMap` should be an object with the following fields:

| Field Name               | Description                                                          | Expected Value                                                                                                                |
| ------------------------ | -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| **`PrimaryKey`**         | Defines which column of the table to use for matching against events | <p>String, number, or array (of strings or numbers)<br>See <a href="..#primary-key-data-types">Primary key data types</a></p> |
| **`AssociatedLogTypes`** | A list of Log Types and the fields of each to use as Selector Keys   | List, see below                                                                                                               |

Each item of `AssociatedLogTypes` must be an object with the following fields:

| Field Name      | Description                                                              | Expected Value  |
| --------------- | ------------------------------------------------------------------------ | --------------- |
| **`LogType`**   | The ID of the Log Schema                                                 | String          |
| **`Selectors`** | A list of fields from the Log Type to be matched against the Primary Key | List of strings |

#### Refresh Specification <a href="#refresh-specification" id="refresh-specification"></a>

`Refresh` defines the configuration for an [S3 Sync](https://docs.panther.com/~/changes/15ann7vKLltCCAGHtdQr/enrichment/lookup-tables/broken-reference). It must be an object with the following fields:

| Field Name          | Description                                                                    | Expected Value                                                        |
| ------------------- | ------------------------------------------------------------------------------ | --------------------------------------------------------------------- |
| **`RoleARN`**       | The AWS ARN corresponding the role Panther can assume to access the S3 object. | String                                                                |
| **`ObjectPath`**    | A URI pointing to the file within the S3 bucket                                | String                                                                |
| **`PeriodMinutes`** | The number of minutes to wait between syncing with the S3 object               | `15`,`30`,`60`,`180` (3 hours),`720` (12 hours), or `1440` (24 hours) |