Enrichment: Adding Context
An IP address is a clue; an enriched IP address is an answer.
Key takeaways
- Enrich data on the fly, as it is ingested — not at investigation time.
- Identity enrichment appends the user's department, manager, and title from Active Directory.
- Asset context tags IPs with network zone (PCI subnet, guest Wi-Fi) and criticality score.
- GeoIP & ASN map external IPs to locations and ISP owners.
A raw IP address or username in a log lacks context. SIEM pipelines must enrich data on the fly as it is ingested, so that by the time an analyst sees an alert, the questions they would ask first are already answered.
- Identity enrichment. Query Active Directory to append the user's department, manager, and title to the log — a failed login from "jsmith" is enriched to show "John Smith — IT Admin".
- Asset context. Tag source and destination IPs with their network zone (e.g., zone: PCI-Subnet, zone: Guest-WiFi) and a criticality score.
- GeoIP & ASN. Map external IPs to geographic locations and ISP owners.
Enrichment is what turns triage from a research project into a judgment call: the same failed login means something entirely different on a domain admin in the PCI zone than on a kiosk in the lobby.
Keep reading — it's free
Register once to unlock every lesson in the Vijilan Cybersecurity Academy, track your progress, and earn domain badges toward the certification. No cost, no sales pitch.
- Every lesson, free
- Progress tracking
- Domain badges
- No credit card