.png?sv=2019-07-07&sig=tWqR0Tf0fPoBzmrC7JYVdU1%2F%2B%2FcJTqF1LqfKYxqoeHU%3D&spr=https%2Chttp&st=2023-12-01T10%3A42%3A14Z&se=2023-12-01T10%3A52%3A14Z&srt=o&ss=b&sp=r){kind=logo}
Manage Custom Enrichment - Enrich Assets with CSV File
- 12 Nov 2023
- 4 Minutes to read
- Print
- DarkLight
- PDF
Manage Custom Enrichment - Enrich Assets with CSV File
- Updated on 12 Nov 2023
- 4 Minutes to read
- Print
- DarkLight
- PDF
Article Summary
Share feedback
Thanks for sharing your feedback!
Manage Custom Enrichment - Enrich assets with CSV file adds or removes custom enrichment data contained in a CSV file to or from assets, using the Custom Enrichment feature.
Custom Enrichment is run on assets that match the results of the selected saved query and match the Enforcement Action Dynamic Value statement, if defined, or assets selected on the relevant assets page. Custom Enrichment is then performed on those asset results that match the rule in the enrichment statement.
In the run history of this enforcement action:
- The Successful count is the number of assets that the custom enrichment rule matched and therefore removed/added the custom enrichment data from/to those assets. For Remove custom enrichment, includes also those assets that are returned by the query and do not have custom enrichment even before running the action.
- The Failed count is the number of assets that the custom enrichment rule did not match and therefore did not remove/add the custom enrichment data from/to those assets.
Refer to Viewing Enforcement Set Run History to learn more about run results.
See Creating Enforcement Sets to learn more about adding Enforcement Actions to Enforcement Sets.
General Settings
- Enforcement Set name (required) - The name of the Enforcement Set. A default value is added by Axonius. You can change the name according to your needs.
- Add description - Click to add a description of the Enforcement Set. It is recommended to describe what the Enforcement Set does.
- Run action on assets matching following query (required) - Select an asset category and a query. The Enforcement Action will be run on the assets that match the query parameters.
- A query only returns results for the asset type it was created for.
- Not all asset categories are supported for all Enforcement Actions.
- See Actions supported for Activity Logs, Adapter Fetch History and Asset Investigation Modules
- See Actions supported for Vulnerabilities.
- See Actions supported for Software.
- Action name (required) - The name of the Main action. A default value is added by Axonius. You can change the name according to your needs.
- Configure Dynamic Values - Toggle on to enter a Dynamic Value statement. See Creating Enforcement Action Dynamic Value Statements to learn more about Dynamic Value statement syntax.
Note:
To enrich all assets, use a query that returns all assets for each asset module. For example, for the Device module, use the All Devices query, and for the User module, use the All Users query.
Required Fields
These fields must be configured to run the Enforcement Set.
- Action type - Select whether to Add or Remove a custom enrichment to or from assets.
- When Remove is selected, the custom enrichments are removed from all assets returned by the query selected. To ensure that the enrichment is removed from all assets, select a query that returns all assets for each asset module.
Select file input method - You can either upload a file from your system, or use a file saved in a storage system.
To upload a file from your system
- From the Select file input method dropdown, choose Upload file.
- Select Choose file to browse for and upload the CSV file. The CSV file must be in the Custom Enrichment CSV File format.
To use a file from an online storage location
Note:If you are uploading a file from an online storage location and you want to use this file only for custom enrichment, you must disable the Active connection setting on the CSV adapter connection. In this case, the CSV adapter connection will not fetch new assets.
Axonius uses the capabilities of the CSV adapter to use a CSV file from a storage location.
Prerequisite: Make sure you have configured the relevant CSV file using a CSV adapter connection. Give a name to the connection (connection label) so that you can identify it in the dropdown list.
- Configure the file name, location and credentials required to access the file using the CSV adapter, these can be SMB, Azure, blob, Amazon S3 bucket etc.
- From the Select file upload method dropdown, choose Select CSV adapter connection.
- From the Select adapter connection dropdown, select the connection that contains the file to be used.
Statement - Enter a custom enrichment statement. Learn how to write a Custom Enrichment statement. Custom fields can also be used in Custom Enrichment statements.
- Syntax Helper - Use the Syntax Helper to get the correct field name. Select the Adapter and the field name from the lists and click
Then, paste the field name into the statement.
- Syntax Helper - Use the Syntax Helper to get the correct field name. Select the Adapter and the field name from the lists and click
Note:
The Adapter Connection Label field is not supported. You can use the following workaround: Create a custom data field, copy the Adapter Connection Label value to that field, and then use the custom field for enrichment.
For more details about other Enforcement Actions available, see Action Library.
Was this article helpful?