Security Operations enrichment data mapping

---
title: Security Operations enrichment data mapping
description: Enrichment Data Mapping transforms data from XML, JSON, or Properties files to ServiceNow records. Security Operations workflows use enrichment data maps and provide output data to security incidents.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/enrichment-data-mapping.html
release: brazil
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Security Operations common functionality, Security Operations]
---

# Security Operations enrichment data mapping

Enrichment Data Mapping transforms data from XML, JSON, or Properties files to ServiceNow records. Security Operations workflows use enrichment data maps and provide output data to security incidents.

Security Operations includes several enrichment data maps, triggered by various workflows, for example, [Security Operations Integrations - Get Network Statistics flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/secops-integration-get-network-stats-workflow.md) and [Security Operations System Command Integration- Get Running Processes flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/obtain-WMI-retrieval-workflow.md). Enrichment data map output from Security Operations workflows is displayed in the **Enrichment Data** tab on the security incident form.

-   **[Create a Security Operations enrichment data map](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/create-enrichment-data-map.md)**  
Transform data from JSON, XML, or Properties file format to ServiceNow records using enrichment data maps.

**Parent Topic:**[Security Operations common functionality](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/sec-ops-common-functionality.md)