Forum Discussion

Sidra_Raza's avatar
Sidra_Raza
Brass Contributor
Sep 07, 2023

Entities missing in Incidents

Hello, Entities are not showing on any of the incidents in Sentinel. Although, I have mapped the entities correctly for each alert.    I have the same alerts and entities mapping on other te...
alerts
integration
siem
ueba
Sidra_Raza's avatar
Sidra_Raza
Brass Contributor
Sep 07, 2023
It's enabled already but no luck.
  • elieelkarkafi's avatar
    elieelkarkafi
    MVP
    Sep 07, 2023

    Sidra_Raza for this analytic rule the entity mapping should look like the below 

     

    • Sidra_Raza's avatar
      Sidra_Raza
      Brass Contributor
      Sep 09, 2023
      I did the same mappings
      • samikroy's avatar
        samikroy
        MCT
        Sep 11, 2023
        Could you please revisit the same incidents after some time as the Entity mapping takes a while to populate.

Resources