Run enrichers#
You can run enrichers:
Automatically
Using enrichment rules
Manually
From individual entities and observables in Search and Browse
Enrichers can be run on entities or observables.
Entity |
Enriching an entity runs the enricher on each of its immediately related observables. |
---|---|
Observable |
Enriches the observable. |
Tip
Most enrichers require you to configure them with vendor access credentials before you can run them. See:
Configure enrichers for general configuration documentation.
Extensions documentation for enricher-specific documentation.
Enable an enricher#
You must enable an enricher to make it available to run.
To enable a single enricher:
From the list, select the enricher you want to enable to open it.
Select Enable.
To enable multiple enrichers:
Enrich from graph#
To enrich entities or observables from a graph:
Open a graph.
From the graph, right click an entity or observable.
From the context menu, select Enrich and then one of the following:
Option
Description
All selected
Enrich all selected entities and observables.
Entities only
Enrich selected entities only.
Observables only
Enrich selected observables only.
In the dialog box that appears, select one or more enrichers.
Select Enrich to run the selected enrichers.
Enrich individual entity or observable#
To enrich individual entities or observables:
Select an entity or observable to open it.
You see a list of entities or observables by going to Search > Go to Search and Browse > Entities or Observables from the left navigation bar.
From the menu that appears, select Enrich.
In the dialog box that appears, select one or more enrichers.
Select Enrich to run the selected enrichers.
Enrich multiple entity or observable#
To enrich multiple entities or observables: