Enrichment

Supplement your log data in Panther with context from additional sources

Overview

Enrichment means, effectively, taking a particular field in an incoming log, and expanding it with additional information. This can be especially useful when organizational data (like employee records or cloud infrastructure account data) needs to be referenced in your detections or passed on to an alert.

In Panther, you can store this additional enrichment data in a custom enrichment table, or enable a Panther-managed enrichment. Using these enrichment capabilities in Panther, you can cut through background noise to write higher-fidelity detections and deliver more informative alerts.

Once an enrichment source is set up, you can view stored data and enriched log events.

Enrichment sources or tables are interchangeably referred to as "lookup tables."

Custom enrichments

Custom enrichments let you add custom context to your detections and alerts. Using enrichments saves time by enhancing detections, reducing alert noise, and speeding up investigations.

Custom enrichments may be useful to:

• Convert IPs to asset/user names, or geolocation details

• Group IPs by type (development vs. production for ex.)

• Append context to AWS Account IDs

To learn how to set up custom enrichments, see Custom Enrichments.

Panther-managed enrichments

Anomali ThreatStream

Anomali ThreatStream aggregates multiple threat feeds into a single high-fidelity repository by normalizing, deduplicating, removing false positives from, and enriching threat data—then associating all related threat indicators.

The Panther-managed Anomali ThreatStream enrichment matches your Anomali indicator data against log events ingested into Panther for high-fidelity alerts.

Anomali ThreatStream is a "bring your own API key" log puller. To learn how to use Anomali ThreatStream enrichment, see Anomali ThreatStream.

Google Workspace user profiles

Panther can retrieve and store user data from Google Workspace once you've configured it as a log source. This data can then be referred to in detection logic and search queries.

Learn how to configure your Google Workspace log source for enrichment on Google Workspace Profiles.

IPinfo

IPinfo provides contextual information about IP addresses, including geolocation, ASN and privacy data. You can use IPinfo data to identify suspicious or high-risk actors.

To learn how to leverage IPinfo datasets, see IPinfo.

Open Threat Exchange (OTX)

Open Threat Exchange (OTX) is AlienVault's community-driven threat intelligence platform, where contributors collaborate to identify emerging threats. OTX enrichment in Panther matches OTX pulse data against log events ingested into Panther to generate higher-fidelity alerts.

OTX is a "bring your own API key" log puller. To learn how to use OTX enrichment, see Open Threat Exchange (OTX).

MISP

MISP warning lists are collections of well-known indicators that can be associated to potential false positives or errors. This context may be useful to help you evaluate whether a certain threat indicator is legitimate.

To learn how to enable MISP warning list enrichment, see MISP Warning Lists.

Okta user and device profiles

Panther can retrieve and store user and device data from Okta once you've configured it as a log source. This data can then be referred to in detection logic and search queries.

Learn how to configure your Okta log source for enrichment on Okta Profiles.

Snowflake

Enrich logs with data from your Snowflake instance, like user and role information.

To learn how to set up Snowflake enrichment, see Snowflake Enrichment.

Tor Exit Nodes

Tor is an anonymizing network sometimes used by bad actors to hide their location. The Panther-managed Tor enrichment contains IP addresses for the Tor Exit Nodes.

To learn how to use Tor Exit Nodes enrichment, see Tor Exit Nodes.

TrailDiscover

TrailDiscover is a continuously evolving repository of CloudTrail events containing detailed descriptions, MITRE ATT&CK insights, real-world incident references, research links, and information about security implications.

To learn how to enrich with TrailDiscover, see TrailDiscover.

Panther-managed enrichment methods

"Bring your own API key" log pullers

This enrichment source requires you to create an API key in the enrichment source, then input it into Panther:

• Anomali ThreatStream

Panther log source pullers

These enrichment sources pull enrichment data from a log source you've set up in Panther.

• Google Workspace Profiles

• Okta Profiles

• Snowflake

Additional enrichment sources

These enrichment sources can be enabled using Detection Packs or the Panther Analysis Tool:

• IPinfo

• MISP Warning Lists

• Tor Exit Nodes

• TrailDiscover

Viewing stored enrichment data

You can use Data Explorer to view data stored in custom and Panther-managed enrichments.

Custom enrichments

To view stored custom enrichment data:

1. In left-side navigation bar in your Panther Console, click Configure > Enrichments.

2. In the upper-right corner of the tile of the Enrichment you'd like to view, click the three dots icon (...), then View In Data Explorer.

   • You will be redirected to Data Explorer, and a SELECT query will be pre-populated.

3. Below the SQL editor, click Run Search.

   • You can view table data in the Results section, below the SQL editor.

Panther-managed enrichments

You can also view the enrichment data associated with a particular event value using Search—learn how to do so here.

Viewing log events with enrichment data

Log events are enriched before being run through associated detections, but they are not enriched when stored in the data lake. This means log data queried from the data lake will not contain p_enrichment. (Signals queried from panther_signals.public.correlation_signals, however, do contain enrichment data.)

It may be useful to know how an enriched log event will look when it's processed by your detection(s). For an exact recreation, you can enrich a log event as a unit test. For an approximate recreation, you can perform a join in Data Explorer.

Enriching a log event as a unit test

For a perfect recreation of how an enriched log event will look as it's processed by your detection(s), create a unit test, add the event, and enrich the test data. (It's not necessary to then save the unit test.)

Joining log and enrichment data

In Data Explorer, you can perform a join between the log and enrichment data with a query like the following:

with logs as 
(select * from panther_logs.public.my_logs),
lookup as (select * from panther_lookups.public.my_lookup_table) 
select logs.fieldA, lookup.fieldB 
from logs join lookup on logs.selector_field = lookup.key_field

Troubleshooting enrichment

Visit the Panther Knowledge Base to view articles about enrichment that answer frequently asked questions and help you resolve common errors and issues.