# Enrich

Looks up an external data source from event fields and writes the result into other fields. It is like [set field](/en/rules/actions/set_field/), but with a looked-up value instead of a fixed one.

Enriched values enter the working memory, so a later condition can decide based on them. Because they are written to event fields, they become available for querying, metrics, and monitors.

## Issuer by BIN

Resolves a card BIN to the corresponding issuer.

| Slot                     | Field type                |
| :----------------------- | :------------------------ |
| Source: BIN              | Text, Integer             |
| Destination: Issuer ID   | Integer, Text             |
| Destination: Issuer country | Text (ISO 3166-1 alpha-2) |

The source field can hold the 6- or 8-digit BIN or the full card number; characters that are not digits are ignored. Nothing is written when the BIN matches no known issuer, or when it matches more than one, in which case the answer would be ambiguous.

## IP address data

Resolves what is known about an IP address.

| Slot                     | Field type      | Content                                          |
| :----------------------- | :-------------- | :----------------------------------------------- |
| Source: IP address       | Text            | address to look up                               |
| Destination: ASN         | Integer, Text   | number of the network announcing the address     |
| Destination: IP country  | Text            | country (ISO 3166-1 alpha-2)                     |
| Destination: IP type     | Text            | `relay`, `tor`, `proxy`, `vpn`, or `hosting`     |

The **ASN** identifies the network, not the address: it is the right answer to questions like "how many different networks did this merchant see in the last hour". The **IP type** is only filled in when the address belongs to some anonymizing infrastructure; an ordinary address leaves the field empty, which means "nothing on record", not "trustworthy address". Private, loopback, or malformed addresses do not resolve, and nothing is written.