Security Operations Integration- Enrich Observable capability
The Enrich Observable capability allows you to enrich observables with additional information from a variety of sources using implementation flows. This capability is used during incident response investigations to contain an identified threat.
The Enrich Observable capability has a flow, Security Operations Integration - Enrich Observable flow. When the capability flow runs, it executes additional flows for the activated implementations. You can specify an implementation to use to perform enrichment on the selected observables, or you can perform the enrichment using all implementations that match the supported observable types.
Note: If no implementations are available, capability actions are not displayed in product menus.
- Security Operations Integration - Enrich Observable flow
The Security Operations Integration - Enrich Observable sub flow allows you to enrich observables with additional information from a variety of sources using implementation flow designer.
Parent Topic:Integration capabilities
Related topics
Security Operations Integration- Block Request capability
Security Operations Integration- Email Search and Delete capability
Security Operations Integration- Enrich CI capability
Security Operations Integration- Get Network Statistics capability
Security Operations Integration- Get Running Processes capability
Security Operations Integration- Isolate Host capability
Security Operations Integration- Publish to Watchlist capability
Security Operations Integration- Sightings Search capability