Skip to main content
Question

Need help on UDM Enrichment

  • August 27, 2026
  • 1 reply
  • 22 views
Ameya

Hi Everyone,

I have a problem around UDM enrichment and I would appreciate if someone can guide me to resolve this. 

Problem :

The current user data is enriched with Azure AD Context and it is pulling all the data that is associated with the user present in the Azure AD. But, every user’s attributes have at least 500+ key-value pairs which are getting enriched as a part of the AD Context which is making the event data heavy with essentially too much garbage data that we don’t need at all. Below is one example:

 

This screenshot is from the event details under the event tab:

Because of this, the actual event/incident details are fully buried under this garbage.

 

This is the SIEM Event details :
 

 

I have checked the documentation and did not find any way to remove the user attribute fields or configuration of event enrichment.

 

Thanks in advance!

    1 reply

    MitchellR
    Forum|alt.badge.img+2
    • MitchellRBronze 1
    • Bronze 1
    • August 27, 2026

    Hi ​@Ameya, there are two paths you could take here:

    1. write a parser extension that no-ops the extraneous fields you’re receiving from the source 
    2. disable the applicable enrichment block(s) to prevent said enrichment from occurring (docs here: https://docs.cloud.google.com/chronicle/docs/event-processing/block-enrichment-flows)

    Given the massive number of enrichment fields shown there, it’s also possible that the provenance fields specifically are incorrectly stitching together / keying off an identifier, thus merging unrelated entities and leading to the large excess in unhelpful fields? 

      Terms & ConditionsAccessibility statement
      Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

      © 2025 Google. All rights reserved.