Storm flux config
解析后的数据
EnrichmentAdapter
Threat Intel Bolt
通过配置的数据获取器获取数据generateMessage
通过数据类型获取从Zookeeper同步的配置信息getSensorEnrichmentConfig
Enrichment Adapter
Data Store
Metron Enrichment loader Framework
Kafka indexing topic
Storm Flux
EnrichmentStrategy
Fast Cashe
根据富集类型分割数据splitMessage
调用富集器enrich
Metron Threat Loader Framework
Metron parsing
Writer Bolt
Kafka enrichments topic
Zookeeper Config
ThreatIntel Join
Enrichment Bolt
/usr/metron/0.7.2/flux/enrichment/remote.yaml
Metron Enrichment
THREAT_INTEL
get
通过Zookeeper 管理配置富集参数
MessageUtils
开始富集messageapply
EnrichmentConfigurations
ENRICHMENT
/usr/metron/0.7.2/config/zookeeper/enrichments/*.json
splitMessage
UnifiedEnrichmentBolt
Enrichment Join
创建富集回调new EnrichmentCallable
Metron Indexing
ThreatIntelEnrichmentAdapter
EnrichmentCallable
获取数据类型getSensorType
MessageGetStrategy
Enrichment Toplogy
ParallelEnricher
配置Storm 流结构和相关富集配置（富集类型）
通过类型获取配置的富集器enrichmentsByType.get
