Non-Mapping Enrichment Item Object

Defines the schema for an alert tag.

API Endpoints/resources/v2.1/enrichments-config/tags/{TAG_NAME}/enrichments
Supported MethodsPOST, GET, PATCH, DELETE

Enrichment Item Parameters (Composition & Extraction)

For composition and extraction enrichment items, a unique object is created for each item.

The enrichment item object schema includes the following attributes:

AttributeDescriptionTypeExample
idSystem-generated unique identifier for the automatic enrichment item.String"191217f6-481d-464e-9f12-3ed846a72555"
typeAutomatic Enrichment rule type.

One of: composition, extraction
String"composition"
activeWhether the rule should be applied to incoming alerts.Booleantrue
whenA BPQL query to filter incoming alerts. Only matched alerts will receive a value based on the enrichment item.Object{
"IN": [
"source_system",
[
{
"type": "regex",
"value": "*"
}
]
]
}
versionInternal version number of the current enrichment item.

This number is incremented automatically each time the item is updated.
Integer1
configRules for building or extracting tag values from event data.

Configuration attributes are unique to the enrichment type. See the Config Attributes tables for more information.
Object{
“source”: “nagios”,
"destination": "tag_name",
"value": "val-${host6666}"
}
OR
{
"source": "host",
"destination": "tag_name",
"regex": "(.*)",
"template": null
}
created_byThe unique ID associated with the user who created the enrichment item.String"60c5238222fa55553d93d555"
updated_byThe unique ID associated with the user who last updated the enrichment item.String"60c5238222fa55553d93d555"
noteA description of the enrichment item purpose or functionality.String"adding region" OR "special extraction for nagios"

Config Object Attributes

Composition Config Attributes

AttributeDescriptionTypeExample
sourceFilter incoming alerts by event source. Only alerts from the listed source system will receive a value based on the enrichment item.

If left empty, source will default to all sources.
String“source”: “nagios"
destinationWhich tag the enrichment item will apply to.String"destination": "tag_name"
valueTemplate for building a value based on existing tags and string values.String"value": "val-${host6666}"

Extraction Config Attributes

AttributeDescriptionTypeExample
sourceFilter incoming alerts by event source. Only alerts from the listed source system will receive a value based on the enrichment item.

If left empty, source will default to all sources.
String"source": "host"
destinationWhich tag the enrichment item will apply toString"destination": "tag_name"
regexThe pattern for extracting tag value from alert data

When extracting from the description field, regex only pulls from the first 300 characters
String"regex": "(.*)"
templateThe structure of the value - system field

This value should not be modified.
String"template": null

Mapping Enrichment Items

Mapping enrichments are managed through their map object. See the Best Practices for Mapping Enrichments for details on defining mapping enrichments.

Example Tag with Enrichment Items

{
"name": "tag_name",
"active": true,
"description": "",
"enrichments": [
{
"type": "extraction",
"active": true,
"when": {},
"config": {
"source": "host",
"destination": "tag_name",
"regex": "(.*)",
"template": null
},
"note": null
},
{
"type": "composition",
"active": true,
"when": {},
"config": {
"destination": "tag_name",
"value": "val-${host6666}"
},
"note": "wiki.com"
}
]
}