Enrichment

Adding context to raw events and alerts, such as resolving an IP to a host and owner, tagging asset criticality, or attaching threat intelligence, so analysts can interpret and prioritize them faster and more accurately.