Understanding the Entity Enrichment in SOAR

Question

Hi folks,I have a question about the behavior of entity enrichment when an entity is enriched using an action in a particular case.When I view the entity in the Entity Highlight section of the x case, I see the enrichment fields.But, when the same entity is associated with y case, I don't see the enrichment fields.Does entity enrichment only apply to the particular case where it was enriched?However, when I refer the entity in the entity explorer I see those enrichment fields.I want to handle a scenario if an entity is already enriched in x case then it shouldn't get enriched again(if it is enriched with in 24 hrs then we should skip the enrichment using the last_enrichment field).Currently, it will enrich the entity again on the y case as the entity of y case does not contains the enrichment fields.Entity in X CaseEntity in Y CaseEntity Explorer

ylandovskyy · Accepted Answer

Hey @jaymin ,The enrichment fields will only be available for all available new cases. The enrichment will not be available for older cases or cases that were already ingested and are available in parallel.On the Entity page, you will see the latest version of the Entity, that's why you see the field there. Another note, if you are running the enrichment on the "Test" case, then it will be only visible on that case and will not be available in any other case.

Reply

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded