Map Enrichment Examples

The following example shows how you can use the enrich event action to enrich events with custom mapped information when search patterns match:

Example: Enrich events with knowledge base search URL

This example enriches events with an internet search URL based on the CI name:

Enter no search patterns in the Event Search tab, so that all events are included in the policy. Click Search if you want events to appear on the Enrichment Policy page for previewing changes.
Select Map only as the enrichment type on the Enrichment Configuration page.
Enter the following URL in the Assigned Value field for User Attribute 1 in the Enrichment Property Assignment table on the Enrichment Policy page:
```
http://www.google.com/search?hl=en&q=${pattern1.AlertedMdrElementID }
```
This string is a URL for a Google search that is based on the AlertedMdrElementID value. The value appears as the User Attribute 1 value in the enriched event. You can search based on the value of any event property, and you can change the URL to a company knowledge base.
To include the events from all connectors in the policy, deploy the policy on the Mid-tier connector.