# Data enrichment

Manage [Coralogix data enrichment rules](https://coralogix.com/docs/user-guides/enrichment_rules/index.md) directly from your AI agent. The Model Context Protocol (MCP) server provides a unified tool to create, retrieve, update, and delete supported enrichment rules, and to generate infrastructure-as-code definitions from enrichment configurations.

## Tool

Use `manage_data_enrichments` for all data enrichment rule operations.

| Action value          | Description                                                                                                                                                                                           |
| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `create`              | Create 1 or more data enrichment rules.                                                                                                                                                               |
| `get`                 | Retrieve a specific data enrichment by ID.                                                                                                                                                            |
| `list`                | List supported data enrichment rules with an optional case-insensitive field-name filter.                                                                                                             |
| `update`              | Replace 1 existing enrichment. The enrichment definition must include the existing ID.                                                                                                                |
| `delete`              | Delete a data enrichment by ID.                                                                                                                                                                       |
| `generate_openapi`    | Generate the OpenAPI JSON payload for use with the Coralogix REST API.                                                                                                                                |
| `generate_kubernetes` | Generate a Kubernetes Operator YAML manifest for the [Coralogix Operator](https://coralogix.com/docs/developer-portal/infrastructure-as-code/coralogix-operator/index.md).                            |
| `generate_terraform`  | Generate Terraform configuration for the [Coralogix Terraform Provider](https://coralogix.com/docs/developer-portal/infrastructure-as-code/terraform-provider/coralogix-terraform-provider/index.md). |

## Supported enrichment types

The tool supports the shared Terraform and Kubernetes Operator subset:

| Type                        | Key            | Fields                                                              |
| --------------------------- | -------------- | ------------------------------------------------------------------- |
| Geo enrichment              | `geoIp`        | `fieldName`, `enrichedFieldName`, `selectedColumns`, `withAsn`      |
| Unified Threat Intelligence | `suspiciousIp` | `fieldName`, `enrichedFieldName`, `selectedColumns`                 |
| AWS resource enrichment     | `aws`          | `fieldName`, `enrichedFieldName`, `selectedColumns`, `resourceType` |

## Example prompts

### List enrichment rules

```text
List all supported Coralogix data enrichment rules.
```

### Create enrichment rules

```text
Create a geoIp data enrichment for fieldName client.ip with enrichedFieldName
client_geo and selectedColumns city and country. Also create a suspiciousIp
data enrichment for fieldName source.ip with enrichedFieldName source_threat.
```

### Create an AWS enrichment

```text
Create an AWS data enrichment with fieldName aws.resource_id,
enrichedFieldName aws_metadata, selectedColumns accountId and region,
and resourceType AWS::EC2::Instance.
```

### Generate infrastructure as code

```text
Generate OpenAPI JSON, Kubernetes YAML, and Terraform configuration for geoIp,
suspiciousIp, and aws data enrichment rules. Use fieldName preview.geo,
preview.suspicious, and preview.aws. Do not create or apply anything.
```

## Important behaviors

- **Custom CSV enrichment is not supported.** The tool rejects custom enrichment data and raw enrichment type payloads.
- **Update replaces 1 enrichment.** Provide exactly 1 enrichment with its existing ID.
- **List filtering uses field names.** Data enrichment rules do not have a single stable user-facing resource name.
- **AWS enrichment rules require a resource type.** For example, use `AWS::EC2::Instance`.