Manage enrichment rules#

Manage enrichment rules from the List of enrichment rules.

To get to the list of enrichment rules:

From the left navigation, select Data configuration > Rules > Enrichment.

Go to Data configuration > Rules > Enrichment.#

Enable or disable a rule#

A rule must be enabled for it to take effect.

Enable#

To enable a rule, do one of the following:

From the list of rules

Locate the rule you want to enable.
Select More on the right of that rule.
Select Enable.

Enable a rule.#

From an open rule

Select a rule to open it, then select Enable.

Enable when creating rule

Select Enabled when creating a rule. See Create enrichment rules.

Disable rule#

To disable a rule, do one of the following:

From the list of rules

Locate the rule you want to disable.
Select More on the right of that rule.
Select Disable.

From an open rule

Select a rule to open it, then select Disable.

Run enrichment rules#

Automatically run#

Enrichment rules are automatically run against entities and observables that are ingested, created, or edited while the rule is enabled.

Note

Only an edit that results in a new version of the entity will trigger an enrichment rule run.

You cannot edit observables. Editing an observable’s relation to an entity results in a new version of that entity.

Manually run#

You cannot manually run enrichment rules.

Instead, start an enricher run from an entity itself. See Enrichers.

Edit rules#

To edit a rule, do one of the following:

From the list of rules

Locate the rule you want to edit.
Select More on the right of that rule.
Select Edit.

From an open rule

Do one of the following:

Select Edit from the top right.
Select More > Edit from the top right.

Delete rules#

Caution

Deleting a rule is irreversible. You may want to disable a rule instead.

To delete a rule, do one of the following:

From the list of rules

Locate the rule you want to delete.
Select More on the right of that rule.
Select Delete.

From an open rule

Select a rule to open it, then select Delete.

Filter rules#

Filter by rule name

To filter by Rule name, enter an exact term (case-insensitive) to filter by in the Filter … field.

Filter menu

Select Filter to display the filter menu.

Here, you can filter rules by:

Category	Description
Status	Filter rules by whether they are Enabled or Disabled.
Enrichers	Filter rules by the enrichers they apply to.