Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

How to do Metron Enrichment?

How to do Metron Enrichment?

New Contributor

I have successfully used NiFi to stream data into kafka. From the Metron Management UI i have added a new source of data based on the kafka topic of the data that i had streamed using NiFi. How to i proceed from here to do the enrichment of data which is in json format.

5 REPLIES 5
Highlighted

Re: How to do Metron Enrichment?

Super Collaborator

Hi @new data, once you have added your new source using the Management UI, you can 'EDIT' the sensor from the management UI and then use the 'Schema' section to make various transformation, enrichment and threat intel customizations. You can refer to one of the existing sensors to get an idea of how it is done.

See this screenshot of 'bro' sensor for example.

43599-bro-sensor-transformations-enrichments.png

Re: How to do Metron Enrichment?

New Contributor

After adding the new source and doing enrichment, a new index will be created in the elasticsearch by selecting the options in the advanced setting or there another process that i need to do?

Also if im ingesting json files, the parser type should be jsonmap right? im planning to do geo enrichment based on the ip of source and destination in the json files.

Re: How to do Metron Enrichment?

Super Collaborator
After adding the new source and doing enrichment, a new index will be created in the elasticsearch by selecting the options in the advanced setting or there another process that i need to do?

Yes, that would be the process. You need to remember to create the kafka topic for the new source, if you haven't.

Yup, you can use the JSONMap. Before you set everything up, you can paste a sample message format and confirm that you are able to parse properly. Something like this:

43611-jsonmap-sample-parse.png

Re: How to do Metron Enrichment?

New Contributor

Basic enrichments such as Geo and HBase enrichments can be setup through the UI as @asubramanian suggests. If you need to configure more complex enrichments this can be done through Stellar. Check out this example in the enrichment README.

Re: How to do Metron Enrichment?

New Contributor

Ok noted. Thank you for the info

Don't have an account?
Coming from Hortonworks? Activate your account here