Enrichment
enrichment
The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.
Contents
Attributes
Caption | Name | Type | Is Array | Default | Description |
---|---|---|---|---|---|
Created Time | created_time | Timestamp | The time when the enrichment data was generated. | ||
Data | data | JSON | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | ||
Description | desc | String | A long description of the enrichment data. | ||
Name | name | String | The name of the attribute to which the enriched data pertains. | ||
Provider | provider | String | The enrichment data provider name. | ||
Raw Data | raw_data | JSON | The event data as received from the event source. | ||
Record ID | record_id | String | Unique identifier for the object | ||
Reputation Scores | reputation | Reputation | The reputation of the enrichment data. | ||
Short Description | short_desc | String | A short description of the enrichment data. | ||
Source URL | src_url | URL String | The URL of the source of the enrichment data. | ||
Type | type | String |
The enrichment type. For example: location .
|
||
Unmapped Data | unmapped | Unmapped | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. | ||
Value | value | String | The value of the attribute to which the enriched data pertains. |
References
Referenced By
- Security Finding
- Vulnerability Finding
- Detection Finding
- Data Security Finding
- Incident Finding
- Compliance Finding
- Finding
- Base Event
- Entity Management
- Authentication
- Authorize Session
- User Access Management
- Account Change
- Identity & Access Management
- Group Management
- Memory Activity
- Process Activity
- Kernel Activity
- File System Activity
- System Activity
- Scheduled Job Activity
- Event Log Activity
- Module Activity
- Kernel Extension Activity
- Web Resources Activity
- Web Resource Access Activity
- API Activity
- Datastore Activity
- File Hosting Activity
- Application Lifecycle
- Scan Activity
- Application Activity
- Network File Activity
- Tunnel Activity
- RDP Activity
- HTTP Activity
- Email File Activity
- Network Activity
- DHCP Activity
- FTP Activity
- SSH Activity
- SMB Activity
- DNS Activity
- Email Activity
- NTP Activity
- Email URL Activity
- Network
- User Query
- Discovery Result
- Device Inventory Info
- OSINT Inventory Info
- Software Inventory Info
- User Session Query
- Device Config State
- Discovery
- User Inventory Info
- Device Config State Change
- Peripheral Device Query
- Operating System Patch State
- Process Remediation Activity
- Network Remediation Activity
- Remediation Activity
- File Remediation Activity
- Windows Service Activity
- Windows Resource Activity
- Registry Key Query
- Registry Value Query
- Registry Key Activity
- Prefetch Query
- Registry Value Activity
- Email Delivery Activity
Context
JSON
{
"caption": "Enrichment",
"description": "The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.",
"extends": "object",
"name": "enrichment",
"attributes": {
"created_time": {
"description": "The time when the enrichment data was generated.",
"requirement": "recommended",
"caption": "Created Time",
"type": "timestamp_t"
},
"data": {
"description": "The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.",
"requirement": "required",
"caption": "Data",
"type": "json_t"
},
"desc": {
"description": "A long description of the enrichment data.",
"requirement": "optional",
"caption": "Description",
"type": "string_t"
},
"name": {
"description": "The name of the attribute to which the enriched data pertains.",
"requirement": "required",
"caption": "Name",
"type": "string_t"
},
"provider": {
"description": "The enrichment data provider name.",
"requirement": "recommended",
"caption": "Provider",
"type": "string_t"
},
"reputation": {
"description": "The reputation of the enrichment data.",
"requirement": "optional",
"caption": "Reputation Scores",
"type": "reputation"
},
"short_desc": {
"description": "A short description of the enrichment data.",
"requirement": "recommended",
"caption": "Short Description",
"type": "string_t"
},
"type": {
"description": "The enrichment type. For example: <code>location</code>.",
"requirement": "recommended",
"caption": "Type",
"type": "string_t"
},
"src_url": {
"description": "The URL of the source of the enrichment data.",
"requirement": "recommended",
"caption": "Source URL",
"type": "url_t"
},
"value": {
"description": "The value of the attribute to which the enriched data pertains.",
"requirement": "required",
"caption": "Value",
"type": "string_t"
},
"raw_data": {
"group": "context",
"caption": "Raw Data",
"description": "The event data as received from the event source.",
"type": "json_t"
},
"record_id": {
"description": "Unique identifier for the object",
"group": "primary",
"requirement": "required",
"caption": "Record ID",
"type": "string_t"
},
"unmapped": {
"caption": "Unmapped Data",
"description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
"type": "unmapped",
"is_array": true
}
}
}