If you are using Case Management version
9.0
, you should refer to this page
How It Works:
The Subflow 3 - Enrich Observables is a key part of the “On New Table Record - Process Alert” automated workflow, enhancing the quality of observables extracted from incoming alerts. After Subflow 1 - Extract Observables pulls relevant data points (e.g., IP addresses, email addresses, file hashes) from the raw alert payload, this subflow processes them further. It normalizes observables, such as converting text to lowercase for consistency, and applies a predefined template to extract specific patterns like URLs or email addresses, ensuring the observables are ready for tasks like deduplication and analysis.Example of Extracted Observables:
- Alert Data: The alert contains the observable
IP Address: 192.168.1.1
andFile Hash: SHA256: abc123...
. - Enrichment Process: The subflow normalizes these observables and stores them in the database. It also checks for duplicates and ensures that only unique and actionable observables are retained. Any redundant data is removed before it is passed on to the next step in the workflow.