Create Enrichment Data for Record activity

The general purpose Create Enrichment Data for Record workflow activity can be used to enrich multiple types of records.

The Create Enrichment Data for Record activity can be used with any workflow to aid in enrichment.


Possible results for this activity are:

Table 1. Results
Result Description
Success The lookup is successful.
Fail An error occurred while attempting to perform the lookup. More error information is available in the activity output error.

Input variables

Input variables determine the initial behavior of the activity.

Variable Description
domain_id The domain identifier for the domain within which the lookup is being performed.
record_id The identifier of the record this enrichment is associated with. For example, it could be the task_sys_id of a security incident.
record_table The table associated with this record_id. For example, the Task table.
enrichment_mapping_id Identifier for the enrichment mapping used to map the enrichment data.
response_content The raw data saved as a result of this enrichment.
ref_value The identifier for the artifact (for example, an observable) being enriched.
ref_table The table associated with the ref_value.
m2m_table The table where the enrichment data is saved.
m2m_record_field The field in the m2m enrichment table where the record_id is saved.
m2m_record_id The identifier of the associated record (for example, the task id).
m2m_enrichment_field The identifier of the associated enrichment record.

Output variables

The output variables contain data that can be used in subsequent activities.

Table 2. Output variables
Variable Description
enrichment_record_id The identifier for the enrichment.