Forum Discussion
Inconsistent entity information
I'm trying to use a playbook trigged by an analytics rule to automate sending an approval email for things like a new device being registered to a user or MFA settings being changed. When the playbook is triggered I seem to get inconsistent entity information from the incident, for example sometimes "accountname" only shows first.last and sometimes accountname is the full UPN which is what I want and what's specified in the analytics rule. Because of this the playbook fails later when I try to use the accountname for other things. How can I get this to be consistent?
4 Replies
- You dont mention which rule / data table. But I know we sometimes have had to fix certain Rules to validate the entity information to make it more consistent, for automations to work properly.
https://learn.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts#accounts-not-following-naming-policies
There is some guidance and Rules for this- It seems more like a timing issue of some sort, I have seen different entity information from the exact same account and same rule.
