Blog Post

Microsoft Sentinel Blog

4 MIN READ

What’s new: Alert Enrichment – Custom Details and Entity Mapping

Microsoft

Mar 09, 2021

We are pleased to announce the new alert custom details and an improved version of entity mapping. Two new features which are part of a series of new alert enrichment capabilities in Microsoft Sentin...

Updated Nov 02, 2021

Version 3.0

microsoft sentinel

JeremyTan

Microsoft

Joined September 26, 2018

View Profile

Microsoft Sentinel Blog

Microsoft Sentinel is an industry-leading SIEM & AI-first platform powering agentic defense across the entire security ecosystem.

gernotb

Copper Contributor

Feb 01, 2022

Limitations

We wouldn’t want the alert to be overloaded, so we will limit the number of key-value pairs to 20 in a single analytics rule and the details are limited to 2 KB collectively. Additional details will be dropped when exceeding the limit.

JeremyTan Are you aware of any plans to increase the 2KB limit for custom details?