Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Fmcp-server%2Ftools%2Fdata-enrichments.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Fmcp-server%2Ftools%2Fdata-enrichments.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# Data enrichment

Manage [Coralogix data enrichment rules](https://docs-docusaurus.kinsta.page/user-guides/enrichment_rules/.md) directly from your AI agent. The Model Context Protocol (MCP) server provides a unified tool to create, retrieve, update, and delete supported enrichment rules, and to generate infrastructure-as-code definitions from enrichment configurations.

## Tool[​](#tool "Direct link to Tool")

Use `manage_data_enrichments` for all data enrichment rule operations.

| Action value          | Description                                                                                                                                                                                               |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `create`              | Create 1 or more data enrichment rules.                                                                                                                                                                   |
| `get`                 | Retrieve a specific data enrichment by ID.                                                                                                                                                                |
| `list`                | List supported data enrichment rules with an optional case-insensitive field-name filter.                                                                                                                 |
| `update`              | Replace 1 existing enrichment. The enrichment definition must include the existing ID.                                                                                                                    |
| `delete`              | Delete a data enrichment by ID.                                                                                                                                                                           |
| `generate_openapi`    | Generate the OpenAPI JSON payload for use with the Coralogix REST API.                                                                                                                                    |
| `generate_kubernetes` | Generate a Kubernetes Operator YAML manifest for the [Coralogix Operator](https://docs-docusaurus.kinsta.page/external/coralogix-operator).                                                               |
| `generate_terraform`  | Generate Terraform configuration for the [Coralogix Terraform Provider](https://docs-docusaurus.kinsta.page/developer-portal/infrastructure-as-code/terraform-provider/coralogix-terraform-provider/.md). |

## Supported enrichment types[​](#supported-enrichment-types "Direct link to Supported enrichment types")

The tool supports the shared Terraform and Kubernetes Operator subset:

| Type                        | Key            | Fields                                                              |
| --------------------------- | -------------- | ------------------------------------------------------------------- |
| Geo enrichment              | `geoIp`        | `fieldName`, `enrichedFieldName`, `selectedColumns`, `withAsn`      |
| Unified Threat Intelligence | `suspiciousIp` | `fieldName`, `enrichedFieldName`, `selectedColumns`                 |
| AWS resource enrichment     | `aws`          | `fieldName`, `enrichedFieldName`, `selectedColumns`, `resourceType` |

## Example prompts[​](#example-prompts "Direct link to Example prompts")

### List enrichment rules[​](#list-enrichment-rules "Direct link to List enrichment rules")

```
List all supported Coralogix data enrichment rules.
```

### Create enrichment rules[​](#create-enrichment-rules "Direct link to Create enrichment rules")

```
Create a geoIp data enrichment for fieldName client.ip with enrichedFieldName

client_geo and selectedColumns city and country. Also create a suspiciousIp

data enrichment for fieldName source.ip with enrichedFieldName source_threat.
```

### Create an AWS enrichment[​](#create-an-aws-enrichment "Direct link to Create an AWS enrichment")

```
Create an AWS data enrichment with fieldName aws.resource_id,

enrichedFieldName aws_metadata, selectedColumns accountId and region,

and resourceType AWS::EC2::Instance.
```

### Generate infrastructure as code[​](#generate-infrastructure-as-code "Direct link to Generate infrastructure as code")

```
Generate OpenAPI JSON, Kubernetes YAML, and Terraform configuration for geoIp,

suspiciousIp, and aws data enrichment rules. Use fieldName preview.geo,

preview.suspicious, and preview.aws. Do not create or apply anything.
```

## Important behaviors[​](#important-behaviors "Direct link to Important behaviors")

* **Custom CSV enrichment is not supported.** The tool rejects custom enrichment data and raw enrichment type payloads.
* **Update replaces 1 enrichment.** Provide exactly 1 enrichment with its existing ID.
* **List filtering uses field names.** Data enrichment rules do not have a single stable user-facing resource name.
* **AWS enrichment rules require a resource type.** For example, use `AWS::EC2::Instance`.