Enriching Telemetry Events Overview
After the raw security telemetry events have been parsed and normalized, you need to enrich the data elements of the normalized event.
CCP supports two types of configurations: global and sensor specific. The sensor specific configuration configures the individual enrichments and threat intelligence enrichments for a given sensor type (for example, squid). This section describes sensor specific configurations.
- Telemetry events
- Threat intelligence information
CCP provides the following telemetry enrichment sources but you can add your own enrichment sources to suit your needs:
Prior to enabling an enrichment capability within CCP, the enrichment store (which for CCP is primarily HBase) must be loaded with enrichment data. The dataload utilities convert raw data sources to a primitive key (type, indicator) and value and place it in HBase.
Bulk load from HDFS via MapReduce
Flat File ingestion
For simplicity's sake, we use the bulk loader to load enrichments: