Enrich

Looks up an external data source from event fields and writes the result into other fields. It is like set field, but with a looked-up value instead of a fixed one.

Enriched values enter the working memory, so a later condition can decide based on them. Because they are written to event fields, they become available for querying, metrics, and monitors.

Issuer by BIN

Resolves a card BIN to the corresponding issuer.

Slot	Field type
Source: BIN	Text, Integer
Destination: Issuer ID	Integer, Text
Destination: Issuer country	Text (ISO 3166-1 alpha-2)

The source field can hold the 6- or 8-digit BIN or the full card number; characters that are not digits are ignored. Nothing is written when the BIN matches no known issuer, or when it matches more than one, in which case the answer would be ambiguous.

IP address data

Resolves what is known about an IP address.

Slot	Field type	Content
Source: IP address	Text	address to look up
Destination: ASN	Integer, Text	number of the network announcing the address
Destination: IP country	Text	country (ISO 3166-1 alpha-2)
Destination: IP type	Text	relay, tor, proxy, vpn, or hosting

The ASN identifies the network, not the address: it is the right answer to questions like “how many different networks did this merchant see in the last hour”. The IP type is only filled in when the address belongs to some anonymizing infrastructure; an ordinary address leaves the field empty, which means “nothing on record”, not “trustworthy address”. Private, loopback, or malformed addresses do not resolve, and nothing is written.