Enrichment

Enrichment involves querying threat intelligence feeds, asset databases, identity directories, or external sources to gather additional context about IP addresses, domains, file hashes, users, or devices involved in an alert. Enrichment is a foundational step in determining whether an alert represents a real threat, but it is time-consuming and repetitive when done manually at scale. Automating enrichment is one of the highest-value use cases for SOC automation.