opensearch-project / opensearch-project/security-analytics
[FEATURE] Enrichment of events with other datasets stored in opensearch
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 111
- Forks
- 111
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 13
Description
Is your feature request related to a problem?
Some events I receive are not useful until they have been enriched with other data - for example enriching IP addresses with corporate inventory details, public datasets such as WHOIS, known scanners, proxies etc
What solution would you like?
A way of enriching events as they are ingested with other datasets.
What alternatives have you considered?
- MISP connector with Memcached on opensearch
- https://github.com/Cargill/OpenSIEM-Logstash-Parsing/tree/1.0/doc/enrichments
- Logstash with sqlite DB
Do you have any additional context?
See comments in #2
https://forum.opensearch.org/t/feature-request-enrich-processor/2108
https://forum.opensearch.org/t/enrich-processor/7597
https://forum.opensearch.org/t/alternative-for-enrich-processor/11201
https://forum.opensearch.org/t/ingest-pipelines-support/7716
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the comments in #2 and the linked OpenSearch forum discussions to understand the intended enrichment behavior and constraints. Review how events are ingested and how datasets in OpenSearch are accessed; done requires a defined implementation scope and tests showing events enriched from the selected datasets.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, database
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100