How would you create a contextualization engine? What are the essential building
blocks? We asked ourselves these questions after studying what's out there and
built from scratch a high-performance contextualization framework in Tenzir.
This blog post introduces this brand-new framework, provides usage examples, and
describes how you can build your own context plugin.
Lookup Table Bloom Filter Custom Type enrich GeoIP libmaxminddb Context Context Type context create context delete context update use manage key 6.6.6.6 0.9 evil 6.6.6.7 0.1 benign 6.6.6.8 0.7 evil h1(x) h2(x) libmaxminddb context label score from <url> | context update <ctx> key=<field> context create <ctx> lookup-table context delete <ctx> export --live | enrich <ctx> --field <field>
