A city enrichment pipeline adds GeoIP, WHOIS, and CMDB owner to every external IP in alerts. What enrichment practice is that?

A city enrichment pipeline that adds GeoIP, WHOIS, and CMDB owner to every external IP in alerts is performing standard alert enrichment for civic SOC triage. GeoIP gives rough geography, WHOIS adds registration context, and CMDB owner ties the destination or source to a municipal asset steward. Attaching those fields automatically shrinks the time analysts spend researching stranger addresses and improves handoff quality to bureau owners when a city system is involved.

Why the other options fail by concept: Identity enrichment that attaches GeoIP, WHOIS, and CMDB owner to external IPs in alerts mislabels the function, because identity enrichment adds user and account context, while this pipeline adds standard descriptive context of geography, registration, and owner. Vulnerability enrichment that attaches GeoIP, WHOIS, and CMDB owner to external IPs in alerts mislabels the function, because vulnerability enrichment adds CVE severity and exposure context, while this pipeline adds standard descriptive context of geography, registration, and owner. Behavioral enrichment that attaches GeoIP, WHOIS, and CMDB owner to external IPs in alerts mislabels the function, because behavioral enrichment adds baseline and anomaly activity context, while this pipeline adds standard descriptive context of geography, registration, and owner.

Exam caveat: Enrichment quality depends on feed freshness and CMDB accuracy; stale WHOIS or missing CMDB owners can mislead just as badly as no enrichment. Operational check: submit a test alert with a known external IP, confirm GeoIP, WHOIS, and CMDB owner fields populate before analyst pickup, and spot-check that CMDB owner matches the city's asset inventory for that related civic host or service.