Rules for enrichers
Enrichment rules define what to do with the retrieved enrichment data.
Rules act like filters, and they set the logical constraints defining:
The platform data sources to augment with enrichment information.
Data sources you can enrich are incoming feeds, other enrichers, and groups.
Within the selected platform data sources, the entity type(s) to augment with enrichment information.
The enrichers to use to fetch enrichment data.
Contents
View enrichment rules
To open the enrichment rule overview, go to Data configuration 
> Rules > Enrichment. This displays a list of all enrichment rules.
Sort the list in ascending 
or descending 
order by selecting the column title.
You can also view an enrichment rule by opening it from a specific enricher overview. To do this:
Open an enricher. Go to Data configuration
> Enrichers and select an enricher from the list.In the panel that opens, look for the Enrichment rules field.
Select a displayed enrichment rule name to open it.
Add enrichment rules
To add a new enrichment rule, do the following:
Open enrichment rule overview.
Select Create rule + in the top left.
In the Create enrichment rule panel, fill out these fields:
Required fields are marked with an asterisk (*).
Field name
Description
Name*
Enter a name to identify this rule.
Description
Enter a description for this rule.
Filters
Select + Add or +More to add rule filters.
Enrichers*
Select at least one enricher to apply this rule to.
Select Save.
Enrichment rule filters
Filters for enrichment rules allow you to define a set of conditions an entity must match to trigger that enrichment rule.
Filters are additive.
Rules trigger when an entity matching the rule is created, ingested, or modified.
Define at least one filter for your enrichment rule.
For each enrichment rule filter, you can set the following conditions:
|
Field name |
Description |
|
Source |
Select a source from the list. A filter with a defined Source is only triggered by entities from that source. Sources can be feeds, enrichers, or platform groups. Leave blank to trigger the rule with an entity from any source. |
|
Entity types |
Select an entity type from the list. A filter with a defined Entity type is only triggers by an entity of that type. Leave blank to trigger the rule with an entity of any type. |
|
TLP |
Select a TLP color from the list. A filter with a defined TLP only triggered by entities with that TLP color. Leave blank to trigger the rule with an entity with any TLP color. |
Edit enrichment rule
Open the enrichment rule overview.
Select an existing enrichment rule from the list.
In the panel that appears, select More at the top right.
In the context menu that opens, select Edit
Or:
Open the enrichment rule overview.
Locate an existing enrichment rule from the list to edit.
For that enrichment rule in the list, select More on the far right of it.
In the context menu that opens, select Edit.
Delete enrichment rule
Open the enrichment rule overview.
Select an existing enrichment rule from the list.
In the panel that appears, select More at the top right.
In the context menu that opens, select Delete
Or:
Open the enrichment rule overview.
Locate an existing enrichment rule from the list to edit.
For that enrichment rule in the list, select More on the far right of it.
In the context menu that opens, select Delete.