How to enrich notable events in ES?

[cjharmening]

Hello all,

 We are wanting to enrich events as they become notables in ES before they are sent onto Mission control. Thoughts being, enrich the event via some sort of search ( all the data will be in splunk already) to add , DNS, DHCP, Threat intel and some endpoint data. 

 Is it possible to have a search run for the notable index to gather information from other indexes and add them to the notable event?  If so I would love to discuss.

[JohnEGones]

Have you consulted resources like these?

Using threat intelligence in Splunk Enterprise Security 

Unified App for ES: Enrich and submit notable events - Splunk Intel Management (TruSTAR)