When alerts come into BigPanda they go through our data pipeline. Understanding the order of the pipeline can help you effectively enrich alerts.
Enrichment v2
Normalizer - Alerts get formatted into a BigPanda event
Alert enrichment - The alert gets enriched according to mapping & custom tag logic as defined by the customer. Order of execution by default is determined by when an enrichment was created; however, that order can be adjusted in the UI or via the API.
Maintenance - Alerts that match any maintenance query get marked for maintenance.
Enrichment v1:
Normalizer - Alerts get formatted into a BigPanda event
Enrichment mapping - The alert gets enriched according to mapping uploaded by the user.
Maintenance - Alerts that match any maintenance query get marked for maintenance.
Custom tags (Extraction) - Relevant custom extraction tag logic is executed and applied.
Custom tags (Composition) - Relevant custom composition tag logic is executed and applied.
Looking for more information on BigPanda's data pipeline? Check out our Setting up BigPanda course in BigPanda University.