How to enrich data available in ASIM parser using custom data source?

Question

We have one use case of Alert enrichment in which we need to enrich alerts of other data sources available in Microsoft Sentinel with our custom data source.
For that we have created anlaytic rules based on ASIM parser to generate an incident when IP, Domain, Hash, Url, Hostname are available in that particular ASIM parser table.
We have created a playbook which is triggered by an incident generated by above mentioned analytic rule. In this playbook, we are calling our custom data source API using detail like IP, Domain, Hash, Url, Hostname on which incident is generated and adding data as comment to an incident with proper format if found from custom data source API.
Can you please let us know that approach for Alert Enrichment used by us is proper or not? Also can you suggest any other way to achieve the same usecase?
Here I am attaching a screenshot to explain our workflow for your reference.

Answer 1

I suspect that is how many people do enrichments. I might suggest you put in an automation rule that calls the Playbook (if you dont already) as that often makes the assignment of new Rules easier (and the duration settings help for testing and tagging).

Answer 2

You could ingest this custom data source that you are using for enrichment. Either to a custom table or watchlist. You could also ingest as TI indicators if appropriate. If that data does not to be obscured from the Sentinel operator. Then you could include that data as part of the alert query as a union or join. Maybe surfacing as a custom detail mapping or tag. That would eliminate the reoccurring logic app cost and could make the enrichment more visible.