Adding Enrichment logs to Security Onion

[rockowwc]

What is the best way to add an enrichment pipeline to SO and have all data pass through it.
In this case its a MISP enrichment for Ip's and urls..

[reyesj2]

#14263 has info on setting up enrichment that should be applicable to your question.

If you have any specific questions follow up here please