Security ContentExabeam Security Content in the Common Information Model

Event Types – An array that defines which types of events should be enriched using the enricher. Use empty brackets [] to indicate that the enricher applies to all events.

Enrichment Conditions – Logical expressions that define the conditions under which the enricher should be applied. For example, in the following condition, an event is enriched only if the field some_field ends with .bat, or the field certain_field already exists.

"exists(certain_field) OR endsWith(some_field, '.bat')"

Mapping Fields – Expressions that define new fields and values to be created by the enricher.