Enrichment
The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.
Attributes
Caption | Name | Type | Description |
---|---|---|---|
Created Time | created_time |
Timestamp | The time when the enrichment data was generated. |
Data | data |
JSON | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. |
Description | desc |
String | A long description of the enrichment data. |
Name | name |
String | The name of the attribute to which the enriched data pertains. |
Provider | provider |
String | The enrichment data provider name. |
Raw Data | raw_data |
JSON | The event data as received from the event source. |
Record ID | record_id |
String | Unique identifier for the object |
Reputation Scores | reputation |
Reputation[] | The reputation of the enrichment data. |
Short Description | short_desc |
String | A short description of the enrichment data. |
Source URL | src_url |
URL String | The URL of the source of the enrichment data. |
Type | type |
String |
The enrichment type. For example: location .
|
Unmapped Data | unmapped |
Unmapped[] | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. |
Value | value |
String | The value of the attribute to which the enriched data pertains. |
Relationships
Inbound Relationships
These objects and events reference Enrichment in their attributes:
- Process Remediation Activity
- SMB Activity
- Security Finding
- Module Query
- Device Config State
- Networks Query
- Finding
- Account Change
- Admin Group Query
- Application Lifecycle
- Discovery Result
- File Query
- File Hosting Activity
- Scheduled Job Activity
- Base Event
- Folder Query
- Incident Finding
- Memory Activity
- Data Security Finding
- Email URL Activity
- Software Inventory Info
- Network Remediation Activity
- API Activity
- Network File Activity
- RDP Activity
- Compliance Finding
- Entity Management
- Application Activity
- Job Query
- Email Delivery Activity
- File Remediation Activity
- Email File Activity
- Device Inventory Info
- HTTP Activity
- User Inventory Info
- Datastore Activity
- User Session Query
- User Access Management
- User Query
- FTP Activity
- Operating System Patch State
- Peripheral Device Query
- Authentication
- Network
- Process Query
- Windows Service Activity
- Network Connection Query
- Web Resources Activity
- File System Activity
- Registry Key Query
- Registry Key Activity
- OSINT Inventory Info
- Registry Value Activity
- Authorize Session
- Scan Activity
- Remediation Activity
- Group Management
- SSH Activity
- Service Query
- System Activity
- Event Log Activity
- Tunnel Activity
- DNS Activity
- Kernel Activity
- Network Activity
- Module Activity
- Discovery
- Registry Value Query
- Web Resource Access Activity
- Kernel Object Query
- Process Activity
- Email Activity
- NTP Activity
- Identity & Access Management
- DHCP Activity
- Device Config State Change
- Detection Finding
- Windows Resource Activity
- Prefetch Query
- Kernel Extension Activity
- Vulnerability Finding
Outbound Relationships
Enrichment references the following objects and events in its attributes:
This page describes qdm-1.3.2+ocsf-1.3.0
Updated 20 days ago