Run enrichers

You can run enrichers:

• Automatically

  • Using enrichment rules

• Manually

  • From a graph

  • From individual entities and observables in Search and Browse

Enrichers can be run on entities or observables.

Difference between enriching an entity and enriching an observable:

Entity	Enriching an entity runs the enricher on each of its immediately related observables.
Observable	Enriches the observable.

Tip

Most enrichers require you to configure them with vendor access credentials before you can run them. See:

• Configure enrichers for general configuration documentation.

• Extensions documentation for enricher-specific documentation.

Enable an enricher

You must enable an enricher to make it available to run.

To enable a single enricher:

1. Go to Data configuration > Enrichers.

2. From the list, select the enricher you want to enable to open it.

3. In the panel that opens, select More from the top right.

4. Select Enable.

To enable multiple enrichers:

1. Go to Data configuration > Enrichers.

2. From the list, select checkboxes to the left of the enrichers you want to enable.

3. In the toolbar that appears on top, select More > Enable.

Enrich from graph

To enrich entities or observables from a graph:

1. Open a graph.

2. From the graph, right click an entity or observable.

3. From the context menu, select Enrich and then one of the following:

   Option	Description
   All selected	Enrich all selected entities and observables.
   Entities only	Enrich selected entities only.
   Observables only	Enrich selected observables only.

4. In the dialog box that appears, select one or more enrichers.

5. Select Enrich to run the selected enrichers.

Enrich individual entity or observable

To enrich individual entities or observables:

1. Select an entity or observable to open it.

   You see a list of entities or observables by going to Search > Go to Search and Browse > Entities or Observables from the left navigation bar.

2. In the panel that opens, select More from the top right.

3. From the menu that appears, select Enrich.

4. In the dialog box that appears, select one or more enrichers.

5. Select Enrich to run the selected enrichers.

Enrich multiple entity or observable

To enrich multiple entities or observables:

1. In the left navigation bar, go to Search > Go to Search and Browse > Entities or Observables.

2. Select more than one entity or observable.

3. In the toolbar that appears on top, select Enrich.

4. In the dialog box that appears, select one or more enrichers.

5. Select Enrich to run the selected enrichers.