enrich_alert
Directiveenrich_alert
directive is used in actions to add or update fields in the alert. You specify a list of key-value pairs where:
key
is the field name to add or update.value
is the data to assign to the field. It can be a static value or dynamically derived from steps or other parts of the workflow.disposable
is an optional attribute that determines whether the enrichment is temporary and should be discarded when a new alert is received. If disposable is set to True, the enrichment is added to disposable_enrichments and marked with dispose_on_new_alert=True.get-customer-details
step fetches customer data based on the alert.enrich_alert
directive adds customer_name
and customer_tier
to the alert.