Security Operations enrichment data mapping Enrichment Data Mapping transforms data from XML, JSON, or Properties files to ServiceNow records.Security Operations workflows use enrichment data maps and provide output data to security incidents. Security Operationsincludes several enrichment data maps, triggered by various workflows, for example, NetStatEnrichment, and Running Processes - WMI Enrichment. Enrichment data map output from Security Operations workflows is displayed in the Enrichment Data tab on the security incident form. See Create a Security Operations enrichment data map for more information. Create a Security Operations enrichment data mapTransform data from JSON, XML, or Properties file format to ServiceNow records using enrichment data maps.