The process of adding additional context or information to events during ingestion or querying. Enrichment can include adding geographic information based on IP addresses, user details from lookup tables, threat intelligence data, or calculated fields. This additional context makes data more valuable for analysis and investigation.