Notifications
Clear all
Topic starter
18/08/2026 2:16 pm
TL;DR: Threat intelligence is most effective when enrichment happens upstream in the data pipeline, not after SIEM ingestion, because a shared OCSF schema lets routing, enrichment, and detection logic operate once across telemetry and intelligence, according to TENZIR. That shift can reduce hot-path volume, improve analyst context, and expose the control value of schema alignment.
NHIMG editorial — based on content published by TENZIR: threat-intelligence enrichment with OCSF and the alphaMountain package
Questions worth separating out
Q: How should security teams implement pre-ingestion enrichment in a SIEM pipeline?
A: Start by enriching telemetry at the collection or stream layer, not after storage.
Q: Why does schema alignment matter for threat-intelligence enrichment?
A: Schema alignment lets teams define routing, enrichment, and detection logic once instead of rewriting it for every source.
Q: What breaks when threat intelligence is added only after ingestion?
A: Late enrichment forces the organisation to pay ingest and storage costs before knowing whether data is actionable.
Practitioner guidance
- Normalize telemetry to OCSF first Map DNS, proxy, network, and endpoint feeds into a shared OCSF structure before introducing enrichment logic, so the same routing rules work across sources and destinations.
- Move threat enrichment into the pipeline Use lookup tables or streaming joins to attach intelligence before SIEM ingestion, then reserve query-time lookup for exceptional investigations that need live depth.
- Separate hot-path and long-tail retention Route high-confidence matches to detection workflows and send low-value or unmatched telemetry to the lake for retrospective hunting and compliance retention.
What's in the full article
TENZIR's full blog covers the operational detail this post intentionally leaves for the source:
- The exact TQL pipeline patterns used to map alphaMountain responses into OCSF OSINT Inventory Info events.
- The lookup-table update flow that keeps intelligence fresh without a per-event API call.
- The enrichment and routing logic that separates high-severity detections from long-tail lake retention.
- The live lookup path for deeper WHOIS, ASN, GeoIP, and passive DNS context during investigations.
👉 Read TENZIR's analysis of upstream threat enrichment with OCSF and alphaMountain →
OCSF threat enrichment in motion: what changes for SIEM teams?
Explore further
18/08/2026 3:09 pm
Schema alignment is the real control plane for enrichment. The article shows that telemetry quality is not just a parsing problem, it is a governance problem. When intelligence and telemetry share OCSF, teams can define one routing and enrichment policy instead of maintaining fragmented field mappings across products. That reduces ambiguity in downstream decisions and improves repeatability across the SOC. Practitioners should treat schema consistency as a control, not a convenience.
A question worth separating out:
Q: How do teams decide between cached context and live lookups?
A: Use cached context when the objective is high-throughput enrichment of many events, because lookup tables are the scale pattern. Use live lookups when a single indicator needs more depth, such as WHOIS, passive DNS, ASN, or GeoIP. That split preserves throughput without losing investigative detail.
👉 Read our full editorial: OCSF threat enrichment in motion changes SIEM routing economics
