{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43850,"path":"security-management/create-enrichment-data-map.md","title":"Create a Security Operations enrichment data map","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create a Security Operations enrichment data map\n\nTransform data from JSON, XML, or Properties file format to ServiceNow records using enrichment data maps.\n\n## Before you begin\n\nRole required: sn\\_sec\\_cmn.write\n\n## About this task\n\nExisting enrichment data maps are used by workflows provided within Security Operations. You can view the list under **Enrichment Data Mapping**. To use a map, you need a trigger, either a business rule or workflow.\n\n## Procedure\n\n1.  Navigate to **All** &gt; **Security Operations** &gt; **Utilities** &gt; **Enrichment Data Mapping**.\n\n2.  Select **New**.\n\n3.  Fill in the fields, as appropriate.\n\n<table id=\"table_qfl_nwk_cp\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nName of this enrichment data map.\n\n</td></tr><tr><td>\n\nInput format\n\n</td><td>\n\nChoose a format from the list:-   JSON \\(default\\)\n-   XML\n-   Properties File format\n\n\n</td></tr><tr><td>\n\nPrefix key\n\n</td><td>\n\nUse to limit the input data set to a specified key. The root of the input data set is set to this key. In this example, if you entered file\\_info, then the input values would be limited to those values within file\\_info. ```\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<malware>\n    <version>2.0</version>\n    <file_info>\n        <malware>yes</malware>\n        <sha1>24c051142583e10451a53893fed3aa5d80bfb1f6</sha1>\n        <filetype>PE</filetype>\n        <sha256>be9bd96808173e2d967feef8c8c5b8c4d73b621584fb11eb68434da1e6a0a930</sha256>\n        <md5>ee8c91751b3010e38c479cf9ab09827a</md5>\n        <size>546304</size>\n    </file_info>\n</malware>\n```\n\n</td></tr><tr><td>\n\nApplication\n\n</td><td>\n\nScope of the application.\n\n</td></tr><tr><td>\n\nDuplication rule\n\n</td><td>\n\nRule defining when a record is considered a duplicate and what actions to take with duplicate records.\n\n</td></tr><tr><td>\n\nDestination table\n\n</td><td>\n\nChoose a table from the list.\n\n</td></tr><tr><td>\n\nActive\n\n</td><td>\n\nSelect this check box to activate the map.\n\n</td></tr><tr><td>\n\nDescription\n\n</td><td>\n\nEnter a description of the enrichment data map.\n\n</td></tr></tbody>\n</table>4.  Select **Submit.**\n\n    The Enrichment Data Mapping Fields tab appears.\n\n5.  Select **New**.\n\n6.  Fill in the fields on the form, as appropriate.\n\n<table id=\"table_tql_dvg_lw\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nField\n\n</td><td>\n\nName of the enrichment data map.\n\n</td></tr><tr><td>\n\nValue type\n\n</td><td>\n\nChoose from the list: -   Lookup data using property key\n-   Static value\n-   Static value plus data from the property key\n-   Field is an array or object \\(raw data nesting\\)\n Each choice has different entries. Field values and arrays or objects require a Property key.\n\n</td></tr><tr><td>\n\nProperty key\n\n</td><td>\n\nDetermines the key for the input data search and the value written to the target field.\n\n</td></tr><tr><td>\n\nValue transform\n\n</td><td>\n\nThe field value transform that maps one value to another.\n\n</td></tr><tr><td>\n\nApplication\n\n</td><td>\n\nScope of the application.\n\n</td></tr><tr><td>\n\nOrder\n\n</td><td>\n\nIn what order to consider the mapping. The first match is used. Default is 100.\n\n</td></tr><tr><td>\n\nMapping\n\n</td><td>\n\nName of the enrichment data map.\n\n</td></tr><tr><td>\n\nDestination table\n\n</td><td>\n\nThe table to which the fields to map are going.\n\n</td></tr></tbody>\n</table>7.  Select **Submit**.\n\n\n**Parent Topic:**[Security Operations enrichment data mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/enrichment-data-mapping.md)\n\n"}}