Using data enrichment - Learn about data-enriched fields and their limitations. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM automatically enriches your Cortex Data Model (XDM) data with additional information and context. Some examples of the types of data that are enriched include:

These enrichments are important for cyber analytics, rule detection, and investigations. Since these fields are enriched automatically by default, they do not have to be mapped manually in Data Model Rules. Note that enrichment is not performed when the input fields needed for enrichment are not available.

Enriched data is calculated by the system upon ingestion, and is saved for future queries. Keep in mind that some data may change over time, such as IP addresses that may change geolocation.  Therefore, checking the same IP address in external systems at a later time might return a different geolocation result.

[MODEL: dataset=okta_sso_raw]
| alter xdm.source.ip = actor->ip_address,
      xdm.source.location.country = actor->country,
      xdm.source.location.city = actor->geo.city;