The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Data enrichment

Prev Next

Enrich events sent by the upstream data source with context not in the original event.

Set up data enrichment sources (System Properties → Data Enrichment) by defining how to connect to the database and access one or two table columns in that database. Then define which devices receive the data and how to enrich that data.

Use Data Enrichment to lookup additional information, such as an email address or host location from a database or file, to include as part of an event when it's created.

A connector to the relational data source in Hadoop HBase uses the key-value pairs from the source for enrichment. The identity mapping in HBase can be pulled to a Receiver regularly to enrich events.