Security ContentExabeam Security Content in the Common Information Model

Enrichers that provide contextual enrichment use a parsed field value as a key to extract a value for a new field from a context table.

In the example below, the user field gets its value from a user_email field in a context table called user_email_mapping. When the user_email field is parsed from the log, the AD username is fetched from the context table and mapped to the user field which will stitch the event to the user timeline.

user_email {...
      Map = [
        {
          Field = "user"
          Value = """GetValue('user_email_mapping',toLower(user_email))"""
        }...