Enrichment

enrichment

The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.

Contents

Attributes

Caption Name Type Is Array Default Description
Created Time created_time Timestamp The time when the enrichment data was generated.
Data data JSON The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.
Description desc String A long description of the enrichment data.
Name name String The name of the attribute to which the enriched data pertains.
Provider provider String The enrichment data provider name.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Reputation Scores reputation Reputation The reputation of the enrichment data.
Short Description short_desc String A short description of the enrichment data.
Source URL src_url URL String The URL of the source of the enrichment data.
Type type String The enrichment type. For example: location.
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.
Value value String The value of the attribute to which the enriched data pertains.

Context

Enrichment

JSON

            
{
  "caption": "Enrichment",
  "description": "The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.",
  "extends": "object",
  "name": "enrichment",
  "attributes": {
    "created_time": {
      "description": "The time when the enrichment data was generated.",
      "requirement": "recommended",
      "caption": "Created Time",
      "type": "timestamp_t"
    },
    "data": {
      "description": "The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.",
      "requirement": "required",
      "caption": "Data",
      "type": "json_t"
    },
    "desc": {
      "description": "A long description of the enrichment data.",
      "requirement": "optional",
      "caption": "Description",
      "type": "string_t"
    },
    "name": {
      "description": "The name of the attribute to which the enriched data pertains.",
      "requirement": "required",
      "caption": "Name",
      "type": "string_t"
    },
    "provider": {
      "description": "The enrichment data provider name.",
      "requirement": "recommended",
      "caption": "Provider",
      "type": "string_t"
    },
    "reputation": {
      "description": "The reputation of the enrichment data.",
      "requirement": "optional",
      "caption": "Reputation Scores",
      "type": "reputation"
    },
    "short_desc": {
      "description": "A short description of the enrichment data.",
      "requirement": "recommended",
      "caption": "Short Description",
      "type": "string_t"
    },
    "type": {
      "description": "The enrichment type. For example: <code>location</code>.",
      "requirement": "recommended",
      "caption": "Type",
      "type": "string_t"
    },
    "src_url": {
      "description": "The URL of the source of the enrichment data.",
      "requirement": "recommended",
      "caption": "Source URL",
      "type": "url_t"
    },
    "value": {
      "description": "The value of the attribute to which the enriched data pertains.",
      "requirement": "required",
      "caption": "Value",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    }
  }
}