Create Enrichment

Creates a new composition or extraction enrichment item for the tag.

Authentication

All BigPanda APIs require Bearer Token Authorization in the call headers.

This API uses the User API Key type of Authorization token. Your User API Key must be provided in the header, prefixed by the word Bearer.

Example:
Authorization: Bearer [YOUR_USER_API_KEY]

🚧 Config object required
The config object is required when creating an enrichment item. When adding your array of enrichment items, make sure to expand the config object and include all required parameters.
Different fields are required for composition and extraction type enrichments.

Composition enrichment items

Composition enrichment items are created by defining a value template. The Composition template is a simple formula to populate tag value using strings and other tag values.

Use any tag value as a variable, using the format ${<tag_name>}. For example:
mywiki.com/${host}/${check}

Special formatting is required for tag values that contain encoded characters for URLs. If the tag value contains encoded values for the characters %, +, or a space, use the format ${exact(<tagname>)} to protect the values from being re-encoded.

Composition configs must include the source, destination, and value properties.

Extraction enrichment items

Extraction enrichment items are created by defining a regular expression (regex formula).

Extraction Regex: The Regular expression to extract the new tag value from the source tag value.

Use a caret ^ to indicate starts with and a dollar sign $ to indicate ends with.

Use parentheses to surround the capture group for the extraction. BigPanda uses the contents of the first capture group to create the value of the alert enrichment tag.

Use a non-capturing group to ignore part of the contents.

If a tag value doesn't match the pattern, the alert is not enriched with the alert enrichment item.

Extraction configs must include the source, destination, and regex properties.

Rate limit: 5 requests per second.

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

curl --location 'https://api.bigpanda.io/resources/v2.1/enrichments-config/tags//enrichments' \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "enrichments": [ { "type": "extraction", "active": true, "when": { "AND": [ { "=": [ "status", "warning" ] }, { "IN": [ "source_system", [ "oim.datadog_prod" ] ] } ] }, "config": { "source": "host", "selected_source_system": "oim.datadog_prod", "destination": "service_name", "regex": "^([^-]+)-.*$" }, "note": "Extract service from host" } ] }'

{ "id": "string", "type": "string", "active": true, "when": { "IN": [ "source_system", [ { "type": "regex", "value": "*" } ] ] }, "version": 0, "config": { "source": "string", "destination": "string", "value": "string" }, "created_by": "string", "updated_by": "string", "note": "string" }

Authentication

Composition enrichment items

Extraction enrichment items

Request

Responses

Create Enrichment

Authentication#

Composition enrichment items#

Extraction enrichment items#

Request

Responses

Authentication

Composition enrichment items

Extraction enrichment items