Process and analysis
What is Enrichment?
Attaching known context to raw material, such as resolving a domain or tagging an address with its hosting provider.
Enrichment is adding known context to a raw observable so that someone can decide what it means. An IP address gains its hosting provider, ASN, country and history. A domain gains its registration date and passive DNS records. A hash gains its sandbox report and detection names.
Enrichment is not analysis on its own, but it makes analysis fast. Most triage decisions depend on two or three enriched facts, such as whether a domain is two days old or ten years old.