Entities missing in Incidents

Question

Hello,Entities are not showing on any of the incidents in Sentinel. Although, I have mapped the entities correctly for each alert.&nbsp;&nbsp;I have the same alerts and entities mapping on other tenant and it shows entities there. What could be the issue?&nbsp;Update: I raised the support ticket to microsoft.Issue has been resolved by Microsoft. It was a misconfiguration from the backend.&nbsp;

htnahsin2025 · Answer

Following this thread since we are facing a similar issues with few analytics .

eliekarkafy · Answer

Sidra_Raza&nbsp;Hi , can you check in your sentinel settings if the below settings is enabled&nbsp;Identify advanced threats with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Microsoft Learn&nbsp;&nbsp;

sidra_raza · Answer

It's enabled already but no luck.

eliekarkafy · Answer

Sidra_Raza&nbsp;for this analytic rule the entity mapping should look like the below&nbsp;&nbsp;

cruzaz · Answer

Hi Sidra, this sounds like an issue we had last year with the old queries. I would first, make sure that you are using the latest version of the analytic rule. If you are not, it may be related to this: https://learn.microsoft.com/en-us/azure/sentinel/whats-new#account-enrichment-fields-removed-from-azure-ad-identity-protection-connector

Forum Discussion

Entities missing in Incidents

Share

Resources