Rules | Enrichment | About#

Set Enrichment rules to run enrichers on Entities and their related Observables.

Working with Enrichment rules

Learn how to create Enrichment rules and how to manage Enrichment rules.

Filtering enriched intelligence#

Enrichment rules employ filters that define:

  • Which sources’ intelligence to include in enrichment.

  • Which Entity types to enrich (along with their related Observables).

  • Which TLP levels of Entities to enrich and which TLP levels not to enrich.

Triggering enrichments#

You can configure the runs to happen:

  • when new Entities are ingested.

  • periodically to capture enrichment information that became available after ingestion.

You can set a single rule to operate both on ingestion and periodically.

List of Enrichment rules#

To see the Enrichment rules, from the left sidebar, select Data configuration icon Data configuration > Rules > Enrichment.