How It Works
Key Properties
- Parallel — all providers run simultaneously. A slow provider never blocks others.
- Fault-tolerant — a failing provider returns
success: falseand doesn’t affect other providers. - Cached — results are cached per provider with configurable TTLs. The same IP enriched across 50 alerts hits the provider API once.
- Deterministic — no LLM tokens consumed. Enrichment is pure API calls and rule-based verdict logic.
Builtin Providers
VirusTotal
IP reputation, domain reputation, file hash analysis. Supports
ip, domain, hash_md5, hash_sha1, hash_sha256.AbuseIPDB
IP abuse confidence scoring and category classification. Supports
ip.Okta
User account details, group membership, MFA status, recent activity. Supports
account.Microsoft Entra
User details, sign-in risk, group membership, conditional access status. Supports
account.Malice Verdicts
Each indicator receives a malice verdict based on threshold rules configured per provider:
The final verdict is the worst across all providers:
Malicious > Suspicious > Benign > Pending.
Cache TTLs
Default cache durations (configurable per provider):Enrichment Results Structure
Each indicator’s enrichment results contain two levels per provider:extracted— key fields extracted via configurable field extraction rules. Designed for agent consumption — concise and relevant.raw— the full provider API response. Available for deep analysis but typically not needed by agents.
On-Demand Enrichment
Trigger enrichment for any indicator, even outside of alert ingestion:Runtime-Configurable Architecture
Enrichment providers are runtime-configurable — each provider is a row in theenrichment_providers table with templated HTTP configs, auth credentials, malice threshold rules, and field extraction mappings. A single adapter class (DatabaseDrivenProvider) handles all providers.
This means adding a new provider requires zero code changes — configure it via the API or seed it in the database. See Adding Enrichment Providers for details, or Custom Enrichment Sources for a walkthrough of using Logic Apps, Lambda functions, or internal APIs as enrichment sources.