Entities

Hey SledgeLive 

Theres a few ways you could approach this

You could run a playbook over your incidents to inject the IP into your alert as an entity

Create a custom analytic based on the original for your use case and add in the IP

Unfortunately there's no way to surface custom entities from generated alerts / incidents from Defender into Sentinel....yet