Illuminate Enrichments

Event logs and alerts will often have a severity assigned. Sometimes this event is provided as a plain text severity, and sometimes it is provided as a numeric value. Severity mapping lookups are used to ensure that, where either the text or numeric value is the only value defined, that corresponding value will be defined.

The severity mapping lookups included with Illuminate core:

This lookup takes the gim_event_type_code value and defines the following fields:

Illuminate provides the ability to define category fields for source, destination, and host systems defined in logs. This enrichment will examine the fields source_ip, destination_ip, and host_ip. If the IP address in those fields is in a range that has been added to the network ranges lookup, then any category values defined in that lookup will be assigned to the fields source_category, destination_category, or host_category, respectively.

After installing Security Data Lake Illuminate and enabling any content pack, there will be a lookup added with a lookup adapter titled core_networks_adapter. You can add entries to this lookup adapter and provide one or more category values that will be added to incoming logs.

These lookups will modify some common HTTP fields with useful data. There are two lookup adapters in this group:

Illuminate will detect when the http_response_code field is defined and enrich these events with two fields:

These lookups will enrich events based on the presence of fields associated with network-related event logs.