How are events enriched?
Event enrichment turns a raw actor claim into a more useful intelligence record.
Enrichment Fields
Section titled “Enrichment Fields”Depending on the source and available evidence, enrichment can include:
- organization name normalization
- website and domain matching
- country and sector
- employee range
- duplicate and related-event detection
- leaked-data status
- leak-site URL and screenshot evidence
- actor and leak-site profile links
- file-list indexing coverage
- torrent metadata and peer observations
- comments, analyst notes, and keyword matches
Data Sources
Section titled “Data Sources”eCrime.ch combines automated collection, enrichment services, source metadata, and analyst-maintained context. Some fields are deterministic, such as event IDs and observed URLs. Other fields, such as sector or organization matching, may be corrected as better information becomes available.
Confidence
Section titled “Confidence”Always distinguish between:
- Actor claim: what the leak site states.
- Observed evidence: screenshots, file lists, torrent metadata, or published data seen by eCrime.ch.
- Enrichment: organization and context data added to make the event searchable and useful.
When an investigation depends on a specific field, open the event detail page and review the available evidence.