Community,

Lets say I bring in logs from an endpoint management tool, where the logs will be from an API call which returns the entities of a host (hostname, username, mac, IP, agents installed, etc...).

https://github.com/goog-cmmartin/thatsiemguy/blob/main/misp/chronicle_parser/misp_ioc.conf 
By using the above github repo as reference, I will parse all the entities which is required.

Will this help me in enriching other missing entities in other log sources ? for example I have a firewall log, where only the hostname and username is present in the log. Will it enrich the remaining entites associated to the host and username like mac and its associated IP ?

If this doesn't work, is there any possible method that I can use to add my own enrichment ?