Configure new enrichment
Set up threat intelligence enrichment integrations to automatically gather additional context about observables, search for sightings, or perform threat lookups from external security vendors.
Before you begin
Role required: sn_sec_tisc.admin
Procedure
Navigate to Workspaces > Threat Intelligence Security Center.
Select the Integrations icon.
Configure new enrichment from All Integrations viewIn the **All Integrations** section, select the **Configure new enrichment** action.
Choose an enrichment type from the Configure new enrichment dialog.
The Configure new enrichment dialog displays three enrichment types: Observable Enrichment, Sighting Search, and Threat Lookup.
Configure the enrichment type
From the enrichment types, select your preferred option and select Next.
The system displays available integrations.
Select an integration from the list of available integrations.
The system opens the Create Enrichment Integration page with pre-filled details for the selected integration, such as WHOIS integration.
Complete the Create Integration form fields.
| Field | Description |
|---|---|
| Name | Name for the new enrichment integration. For example, `WHOIS1`. |
| Vendor Name | Name of the vendor. This field is automatically populated. For example, `WHOIS`. |
| Integration Type | Type of integration selected, such as Observable Enrichment. This field is automatically populated.The following Integration Types are supported: - Observable Enrichment - Sighting Search - Threat Lookup |
| Description | Unique description for the new enrichment integration. |
In the Integration Configuration section, configure the integration details.
The Integration Configuration section includes details such as API key, API Client ID or secret, username, and password. These details vary for different integrations.
To create the enrichment integration configuration, select Save.
The system validates the provided details and sets the enrichment integration status to inactive by default.
To store the integration configurations as draft only, select Save as Draft.
You cannot enable an integration when it is saved as draft. If you're not sure about the configuration details, you can use the Save as Draft option. After you get the configuration details, you can complete the draft version and create it.
To enable the enrichment integration, select Enable.
The integration status changes to enabled.
Note: You can also enable, disable, or delete an enrichment integration using the Actions menu on the integration tile.
Parent Topic:TISC Enrichment integrations
Related topics