Skip to main content
Version: v4.27

enrich

Resets data with a context.

context::enrich name:string, key=any,
               [into=field, mode=string, format=string]

Description​

The context::inspect operator shows details about a specified context.

name: string​

The name of the context to inspect.

key = any​

The field to use for the context lookup.

into = field (optional)​

The field into which to write the enrichment.

Defaults to the context name (name).

mode = string (optional)​

The mode of the enrichment operation:

  • set: overwrites the field specified by into.
  • append: appends into the list specified by into. If into is null or an empty list, a new list is created. If into is not a list, the enrichment will fail with a warning.

Defaults to set.

format = string (optional)​

The style of the enriched value:

  • plain: formats the enrichment as retrieved from the context.
  • ocsf: formats the enrichment as an OCSF Enrichment object with fields data, provider, type, and value.

Defaults to plain.

Examples​

Enrich with a lookup table​

Create a lookup table:

context::create_lookup_table "ctx"

Add data to the lookup table:

from {x:1, y:"a"},
     {x:2, y:"b"}
context::update "ctx", key=x, value=y

Enrich with the table:

from {x:1}
context::enrich "ctx", key=x
{
  x: 1,
  ctx: "a",
}

Enrich as OCSF Enrichment​

Assume the same table preparation as above, but followed by a different call to context::enrich using the format option:

from {x:1}
context::enrich "ctx", key=x, format="ocsf"
{
  x: 1,
  ctx: {
    created_time: 2024-11-18T16:35:48.069981,
    name: "x",
    value: 1,
    data: "a",
  }
}

Enrich by appending to an array​

Enrich twice with the same context and accumulate enrichments into an array:

from {x:1}
context::enrich "ctx", key=x, into=enrichments, mode="append"
context::enrich "ctx", key=x, into=enrichments, mode="append"
{
  x: 1,
  enrichments: [
    "a",
    "a",
  ]
}

See Also​

context::create_bloom_filter, context::create_geoip, context::create_lookup_table, context::erase, context::inspect, context::list, context::load, context::remove, context::reset, context::save, context::update