# Enriching Data with Custom Index **URL:** \ **Category:** Kibana\ **Created:** [July 30, 2024, 6:26pm UTC](https://discuss.elastic.co/t/enriching-data-with-custom-index/364084 "2024-07-30T18:26:17Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![FlyNavy](https://avatars.discourse-cdn.com/v4/letter/f/94ad74/32.png) [@FlyNavy](https://discuss.elastic.co/u/FlyNavy)\ **Post date:** [July 31, 2024, 6:37pm UTC](https://discuss.elastic.co/t/enriching-data-with-custom-index/364084/21 "2024-07-31T18:37:29Z")
That part now works. MemberName is now populated in alert generating events based on manually updating custom index. Now I need to get the incoming events to add the MemberSID and MemberName to the custom index. That was the original problem prior to discovering that the mapping was incorrect. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 31, 2024, 6:46pm UTC](https://discuss.elastic.co/t/enriching-data-with-custom-index/364084/22 "2024-07-31T18:46:20Z")
> [@FlyNavy](#): > > Now I need to get the incoming events to add the MemberSID and MemberName to the custom index. Apologies... I am not following... When you say "custom index" is that the enrich lookup index or something else? Are you to figure out how to keep the lookup inventory up to date? ---
**Author:** ![FlyNavy](https://avatars.discourse-cdn.com/v4/letter/f/94ad74/32.png) [@FlyNavy](https://discuss.elastic.co/u/FlyNavy)\ **Post date:** [July 31, 2024, 7:03pm UTC](https://discuss.elastic.co/t/enriching-data-with-custom-index/364084/23 "2024-07-31T19:03:04Z")
Correct. As new event code 4720s come in, I want to pull the SID and Name and add them to the custom index. That enables the enriching process to add the MemberName to the alert generating event. ---
**Author:** ![FlyNavy](https://avatars.discourse-cdn.com/v4/letter/f/94ad74/32.png) [@FlyNavy](https://discuss.elastic.co/u/FlyNavy)\ **Post date:** [July 31, 2024, 7:58pm UTC](https://discuss.elastic.co/t/enriching-data-with-custom-index/364084/24 "2024-07-31T19:58:34Z")
And yes, that is the enrich lookup index ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 31, 2024, 10:34pm UTC](https://discuss.elastic.co/t/enriching-data-with-custom-index/364084/25 "2024-07-31T22:34:21Z")
> [@FlyNavy](#): > > Correct. As new event code 4720s come in, I want to pull the SID and Name and add them to the custom index. That enables the enriching process to add the MemberName to the alert generating event. Easier Said then done.... You could look at using a latest transform and pass the incoming data through it... Use the Event code as the primary data field and it will build up database of all the events etc... Then you could perhaps use that the basis of your enrich data > **[Transform overview | Elasticsearch Guide \[8.14\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-overview.html#latest-transform-overview)** Go to Kibana -\> Management -\> Transforms and try to set it up latest see if that helps... ---
**Author:** ![FlyNavy](https://avatars.discourse-cdn.com/v4/letter/f/94ad74/32.png) [@FlyNavy](https://discuss.elastic.co/u/FlyNavy)\ **Post date:** [August 1, 2024, 7:44pm UTC](https://discuss.elastic.co/t/enriching-data-with-custom-index/364084/26 "2024-08-01T19:44:15Z")
I'll take a look at that. Thanks. ---
**Author:** ![FlyNavy](https://avatars.discourse-cdn.com/v4/letter/f/94ad74/32.png) [@FlyNavy](https://discuss.elastic.co/u/FlyNavy)\ **Post date:** [August 1, 2024, 8:14pm UTC](https://discuss.elastic.co/t/enriching-data-with-custom-index/364084/27 "2024-08-01T20:14:14Z")
I'm not sure transforms will work from the way I understand them from reading the reference. The data enrichment is very time sensitive. The 2 events I need are the account creation event (4720) and the user-added-to-privileged-group event (4732). I need to add the MemberName to the 4732 event to filter it out when the Kibana rule evaluates it. The time difference in the 2 events are below. Less than .05 seconds. 4720 event time 15:50:42.968 4732 event time 15:50:42.981 So I think this is something that has to happen on the ingest side. Is that correct? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 1, 2024, 9:39pm UTC](https://discuss.elastic.co/t/enriching-data-with-custom-index/364084/28 "2024-08-01T21:39:28Z")
Yeah that is not a transform use case... > [@FlyNavy](#): > > So I think this is something that has to happen on the ingest side. Is that correct? Perhaps ... but I don't think that is feasible ingest does not work that way > [@FlyNavy](#): > > I need to add the MemberName to the 4732 event to filter it out when the Kibana rule evaluates it This seems like it is on the alert detection side have you looked at the [EQL](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html) > **[EQL search | Elasticsearch Guide \[8.14\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html#eql-search-sequence)** I think I would open a new topic against the Security SIEM category and show your sequence of events and what you want and do not want... I would be explicit about your use Case and What you want to accomplish and do not assume that it involves enriching one document with another... No one from Security will look at this topic... Sorry for the side track... but I think you are looking at a EQL detection, I could be wrong I am not an exported with EQL (used for sequential events detection) Also any chance you can upgrade from 8.0.0 to say 8.14.3 ? That might help ---
**Author:** ![FlyNavy](https://avatars.discourse-cdn.com/v4/letter/f/94ad74/32.png) [@FlyNavy](https://discuss.elastic.co/u/FlyNavy)\ **Post date:** [August 1, 2024, 10:34pm UTC](https://discuss.elastic.co/t/enriching-data-with-custom-index/364084/29 "2024-08-01T22:34:41Z")
Thank you for all the help. I'll post on that forum and see what i get. [Previous page](https://discuss.elastic.co/t/enriching-data-with-custom-index/364084.md?page=1)