Enrich

Looks up an external data source from an event field and publishes the result as a temporary variable.

Configuration	Content
Enrichment	Issuer by BIN or IP address data
Source	event field looked up
Setting: Result	name under which the result is published; default: issuer_bin or ip_address, depending on the enrichment

The following conditions decide based on the result. To make the result queryable in metrics and monitors, a set field writes the key into the event, as described in Published results:

Condition:  $ip_address != null
Actions:    Enrich: IP address data                     (result: ip_address)
            Set field: ip_asn = %ip_address.asn

Issuer by BIN

Resolves a card BIN to the corresponding issuer. The source, BIN, is a text or integer field.

Key	Label in the panel	Type	Content
issuer_id	Issuer ID	Integer	issuer identifier
issuer_country	Issuer country	Text	issuer country (ISO 3166-1 alpha-2)

The source field accepts the 6- or 8-digit BIN; characters that are not digits are ignored. Send only the BIN: the platform is not designed to receive the full card number.

The action publishes neither key when the BIN matches no known issuer or matches more than one, in which case the answer would be ambiguous.

IP address data

Resolves what is known about an IP address. The source, IP address, is a text field.

Key	Label in the panel	Type	Content	Presence
asn	ASN	Integer	number of the network announcing the address	when the address resolves to a known network
country	IP country	Text	country (ISO 3166-1 alpha-2)	when the address resolves to a known country
ip_type	IP type	Text	relay, tor, proxy, vpn, or hosting	when the address carries a known anonymization indicator

The ASN identifies the network, not the address. It is the right answer to questions like “how many different networks did this merchant see in the last hour”.

The IP type is only published when the address belongs to some anonymizing infrastructure. For an ordinary address, the action does not publish the key. The absence means “nothing on record”, not “trustworthy address”.

Private, loopback, or malformed addresses do not resolve, and the action publishes no key.