Working with Event Policies and Actions › Create an Event Policy with an Enrichment Action › Create a Map Enrichment Action

Create a Map Enrichment Action

To map values to event properties, create an event policy with a map enrichment action. These values are either static or dependent on functions or other event properties. They do not require a connection to an external data source, such as a database or script.

Use the map enrichments as simple enrichments that do not require a data source connection. Consider the following examples:

• You can add static information such as a company URL to one of the user attributes.
• You can manually enter assignees for each type of event in the Assignee property. Then use that information to group alerts by assignee in alert queues.

Follow these steps:

1. Create an event policy that is based on a search pattern, and select Enrich Event as the action type.

   The Enrichment Configuration page opens.

2. Select Map only from the Type drop-down list, and click Next.

   The Enrichment Policy page opens.

3. Enter enrichment values in the Assigned Value column of the Enrichment Property Assignment table for each event property to enrich, and click Next.

   Note: The Parameter Configuration table requires input only when you are extracting the enrichment values from an external source.

   Map enrichment values can be any combination of static text, functions, and the values of other event properties. To access available functions and event properties, use the right-click menu. Only the properties that support enrichment value assignments appear in the Event Property column.

   Note: If you want the user attribute properties to represent the enrichment properties that you assign to them, change the names of the User Attribute properties. However, these properties appear under their original names in the Event Policy dialog, even if you renamed them. Assigning values to these original names properly displays the values under the renamed properties in the Operations Console.

   The Select Data Sources page opens.

4. Save or deploy the policy.