Security Operations enrichment data mapping Enrichment Data Mapping transforms data from XML, JSON, or Properties files to ServiceNow records. Security Operations workflows use enrichment data maps to provide output data to security incidents. Security Operations includes several enrichment data maps triggered by various workflows. For example:Security Incident Response - Get Running Services workflowSecurity Operations System Command Integration - Get Running Processes workflowSecurity Operations Integrations - Get Network Statistics workflow Enrichment data map output from Security Operations workflows is displayed in the Enrichment Data tab on the security incident form. For more information on enrichment data map, see Create a Security Operations enrichment data map. Create a Security Operations enrichment data map Transform data from JSON, XML, or Properties file format to ServiceNow records using enrichment data maps.