Does enrichment alter the original event?
No. The raw event is preserved and additional context is added for analysis.
Enrichment
Wazuh log enrichment
Wazuh produces strong endpoint signals; enrichment makes those signals actionable.
Fields to enrich
Hostname, user, process, file path, source IP, asset criticality, and related FortiGate sessions should be evaluated together.
Value for analysts
Enrichment helps analysts move from a single Wazuh alert to root-cause analysis faster.