Enrichment

enrichment

The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.

Contents

Attributes

Caption Name Type Is Array Default Description
Data data JSON The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.
Name name String The name of the attribute to which the enriched data pertains.
Provider provider String The enrichment data provider name.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Type type String The enrichment type. For example: location.
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.
Value value String The value of the attribute to which the enriched data pertains.

Context

Enrichment

JSON

            
{
  "caption": "Enrichment",
  "description": "The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.",
  "extends": "object",
  "name": "enrichment",
  "attributes": {
    "data": {
      "description": "The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.",
      "requirement": "required",
      "caption": "Data",
      "type": "json_t"
    },
    "name": {
      "description": "The name of the attribute to which the enriched data pertains.",
      "requirement": "required",
      "caption": "Name",
      "type": "string_t"
    },
    "provider": {
      "description": "The enrichment data provider name.",
      "requirement": "recommended",
      "caption": "Provider",
      "type": "string_t"
    },
    "type": {
      "description": "The enrichment type. For example: <code>location</code>.",
      "requirement": "recommended",
      "caption": "Type",
      "type": "string_t"
    },
    "value": {
      "description": "The value of the attribute to which the enriched data pertains.",
      "requirement": "required",
      "caption": "Value",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    }
  }
}