Run enrichers
You can run enrichers:
Automatically
Using enrichment rules
Manually
From individual entities and observables in Search and Browse
Enrichers can be run on entities or observables.
Difference between enriching an entity and enriching an observable:
|
Entity |
Enriching an entity runs the enricher on each of its immediately related observables. |
|
Observable |
Enriches the observable. |
Most enrichers require you to configure them with vendor access credentials before you can run them. See:
Configure enrichers for general configuration documentation.
List of enrichers for enricher-specific documentation.
Enable an enricher
You must enable an enricher to make it available to run.
To enable a single enricher:
Go to Data configuration
> Enrichers.From the list, select the enricher you want to enable to open it.
In the panel that opens, select More
from the top right.Select Enable.
To enable multiple enrichers:
Go to Data configuration
> Enrichers.From the list, select checkboxes to the left of the enrichers you want to enable.
In the toolbar that appears on top, select More
> Enable.
Enrich from graph
To enrich entities or observables from a graph:
Open a graph.
From the graph, right click an entity or observable.
From the context menu, select Enrich and then one of the following:
Option
Description
All selected
Enrich all selected entities and observables.
Entities only
Enrich selected entities only.
Observables only
Enrich selected observables only.
In the dialog box that appears, select one or more enrichers.
Select Enrich to run the selected enrichers.
Enrich individual entity or observable
To enrich individual entities or observables:
Select an entity or observable to open it.
You can see a list of entities or observables by going to Search
> Go to Search and Browse > Entities or Observables from the left navigation bar.In the panel that opens, select More
from the top right.From the menu that appears, select Enrich.
In the dialog box that appears, select one or more enrichers.
Select Enrich to run the selected enrichers.
Enrich multiple entity or observable
To enrich multiple entities or observables:
In the left navigation bar, go to Search
> Go to Search and Browse > Entities or Observables.Select more than one entity or observable.
In the toolbar that appears on top, select Enrich.
In the dialog box that appears, select one or more enrichers.
Select Enrich to run the selected enrichers.