args:
- description: List of entries to extract additional data from.
  isArray: true
  name: enrich
- description: >
    Primary key in the enrichment entries to match against primary
    key in the attribution data structure.
  name: enrich_key
  required: true
- description: Current attribution data structure.
  isArray: true
  name: current
- name: type
  description: What attribution structure to enrich.
  required: true
  predefined:
  - IP
  - Device
  - User
- name: enrich_fields
  description: comma separated list of fields to take enrichment details from
  required: true
comment: Deprecated. No available replacement. >
  This script can be used to enrich context generated by ExpanseAggregateAttribution*
  scripts  with additional details
deprecated: true
commonfields:
  id: ExpanseEnrichAttribution
  version: -1
name: ExpanseEnrichAttribution
outputs:
- contextPath: Expanse.AttributionIP.ip
  description: IP address
  type: string
- contextPath: Expanse.AttributionIP.private
  description: Is the IP private?
  type: boolean
- contextPath: Expanse.AttributionIP.sightings
  description: Number of sessions seen on this device
  type: number
- contextPath: Expanse.AttributionDevice.serial
  description: Serial Number of the device
  type: string
- contextPath: Expanse.AttributionDevice.vsys
  description: VSYS of the device
  type: string
- contextPath: Expanse.AttributionDevice.device-group
  description: Device Group inside Panorama
  type: string
- contextPath: Expanse.AttributionDevice.exposing_service
  description: Is the device exposing the asset?
  type: boolean
- contextPath: Expanse.AttributionDevice.sightings
  description: Number of sessions seen on this device
  type: number
- contextPath: Expanse.AttributionUser.username
  description: Username of the user
  type: string
- contextPath: Expanse.AttributionUser.domain
  description: Domain of the user
  type: string
- contextPath: Expanse.AttributionUser.groups
  description: List of groups the user is member of
- contextPath: Expanse.AttributionUser.display-name
  description: Display Name
  type: string
- contextPath: Expanse.AttributionUser.description
  description: Description of the user
  type: string
- contextPath: Expanse.AttributionUser.sightings
  description: Number of sessions seen on this device
  type: number
script: '-'
tags: []
timeout: '0'
type: python
subtype: python3
dockerimage: demisto/python3:3.10.13.87159
fromversion: 6.0.0
tests:
- No tests (auto formatted)