Enrichment
The context an identity investigation needs and where the platform adds it: AppTags, GeoIP, value mapping, field types, Environment Tables, TRIX enrichments and joins; what the wiki says about MITRE, Sigma and UDM.
What you will do: add application, location, readable values and normalized fields to identity events so timelines and reports read the same across sources.
Identity data arrives as codes and local names: a logon type number, a SID, an IP address, a user name spelled differently by every system. Enrichment turns them into one vocabulary before correlation. Every mechanism below is a platform feature documented in the wiki; the Audity-specific layers are listed at the end with their status.
Mechanisms
| Mechanism | What it adds | Where |
|---|---|---|
| Field types (ftypes) | one meaning for a column across sources — the account, the session id, the host — queried as ftype.<name> | parser; see Parse |
| Value mapping | readable values for codes: Logon Type: 3 to Network, status 404 to Page Not Found; inline, from a properties file, or by regex | parser {map} and {regexp … columnType=map} |
| GeoIP | country, region and city of an address, at parse time ({geoip}) or in a query (geoip, country, city) from the bundled database | parser or search |
| AppTags | the application, environment or business unit an event belongs to; also the permission and time-zone boundary | PortX > Tags > AppTag; see Filter and enrich |
| Environment Tables | shared values — a list of privileged accounts, business hours, the start and end conditions of a session — referenced as ${table:…} in searches and monitors | PortX > Settings > Environment Tables |
| TRIX enrichments | columns copied onto a correlated session: enrichments.servers.all = (host), enrichments.message.all = (message) (cep.hosts is already built in) | TRIX; see Correlation |
| Joins | attributes from a second log on a shared key — a directory export joined to logon events by account | innerjoin custom function |
| Formats on grouping | replace, query, eventquery, useragentdetect, regexp reshape grouped values in a result | Search language reference |
| Output formats | JSON, CEF, QRadar (Windows events as LEEF), CSV, delimited and OpenTelemetry when identity events are forwarded to a SIEM | forwarder transformers; see Formats |
Steps
- Decide the canonical fields: account, source host, target host, action, result. Give each the same ftype on every parser.
- Map codes to words at parse time where everyone needs them (logon types, result codes); leave presentation-only reshaping to
formatin the query. - Add a
{geoip}field on every address column that reaches a dashboard. - Put every identity source in one AppTag so
in app.<name>scopes searches, Analytics and permissions together. - Keep lists that change — privileged accounts, service accounts, maintenance windows — in Environment Tables, never in the query.
- On the forwarder to the SIEM choose the format the destination normalizes best.
MITRE ATT&CK, Sigma and UDM
- UDM appears in the dock price book as one of the Transform Premium output formats (UDM, ASIM, OpenTelemetry) a forwarder can emit; the wiki documents the OpenTelemetry formatter and does not document a UDM or ASIM mapping.
- MITRE ATT&CK and Sigma are not mentioned anywhere in the wiki (the word Sigma appears only in the names of the anomaly algorithms). Whether Audity tags events with ATT&CK techniques or evaluates Sigma rules is pending confirmation from XPLG engineering and is not stated here.
Next: Flux
Source: XPLG wiki, pages 1594131792, 1594132630, 1594132634, 1594130539, 1594133306, 1718583297, 1602191804, 1594130851, 1635549221, 1636827137, 1594131316 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1594131792); dock price book. Pending confirmation from XPLG engineering: MITRE ATT&CK, Sigma and UDM support in Audity.
