Defines the schema for an alert enrichment (Enrichment V2)
API Endpoints |
|
|---|---|
Supported Methods |
|
Parameters
The Enrichment item object schema includes the following attributes:
Attribute | Description | Example |
|---|---|---|
active | Whether the enrichment item is applied to all incoming alert data. |
|
id | System-generated unique identifier for the enrichment item. |
|
version | Internal version number of the current data mapping table for this enrichment item. This number is incremented automatically each time the table/item is updated. |
|
type | Enrichment function type used to create enrichment items. |
|
config | Configuration details associated with the enrichment technique. | For a mapping enrichment, this attribute contains the map's definitions like table name, query & result tags and note. |
when | A BPQL query for filtering the incoming alerts to be enriched | BPQL string, BPQL object or boolean "when": true "when": |
note | A description |
|
`