Manage enrichment rules

Manage enrichment rules from the List of enrichment rules.

To get to the list of enrichment rules:

• From the left navigation, select Data configuration > Rules > Enrichment.

  

  Go to Data configuration > Rules > Enrichment.

Enable or disable a rule

A rule must be enabled for it to take effect.

Enable

To enable a rule, do one of the following:

From the list of rules

1. Locate the rule you want to enable.

2. Select More on the right of that rule.

3. Select Enable.

   

   Enable a rule.

From an open rule

Select a rule to open it, then select Enable.

Enable a rule.

Enable when creating rule

Select Enabled when creating a rule. See Create enrichment rules.

Disable rule

To disable a rule, do one of the following:

From the list of rules

1. Locate the rule you want to disable.

2. Select More on the right of that rule.

3. Select Disable.

From an open rule

Select a rule to open it, then select Disable.

Run enrichment rules

Automatically run

Enrichment rules are automatically run against Entities and Observables as they are ingested or created.

If you edit an Entity (in such a way that a new version is created) while there is an active Enrichment rule for that Entity, the Enrichment will be run against the Entity and related Observables.

Note

You cannot edit Observables. Editing an Observable’s relation to an Entity results in a new version of that Entity.

Manually run

You cannot manually run enrichment rules.

Instead, start an enricher run from an entity itself. See Enrichers.

Edit rules

To edit a rule, do one of the following:

From the list of rules

1. Locate the rule you want to edit.

2. Select More on the right of that rule.

3. Select Edit.

From an open rule

Do one of the following:

• Select Edit from the top right.

• Select More > Edit from the top right.

Delete rules

Caution

Deleting a rule is irreversible. You may want to disable a rule instead.

To delete a rule, do one of the following:

From the list of rules

1. Locate the rule you want to delete.

2. Select More on the right of that rule.

3. Select Delete.

From an open rule

Select a rule to open it, then select Delete.

Filter rules

Filter by rule name

To filter by Rule name, enter an exact term (case-insensitive) to filter by in the Filter … field.

Filter menu

Select Filter to display the filter menu.

Here, you can filter rules by:

Category	Description
Status	Filter rules by whether they are Enabled or Disabled.
Enrichers	Filter rules by the enrichers they apply to.