Forum Discussion
Solved
Investigate button enabled when it shouldn't be
I've been told that the Incident Investigate button needs at least 1 Entity to have a value before it can be enabled. However I am seeing an incident that was generated from MCAS show up with no ent...
This is a special case. When using "Microsoft incident" rules which elevate alerts from Microsoft products to Incidents, we use the standard schema of Microsoft alerts to map automatically a large number of entities. Those are not exposed in the incident page today, but are used for investigation and you have experiences.
~ Ofer
Ofer_Shezaf
Microsoft
Microsoft
This is a special case. When using "Microsoft incident" rules which elevate alerts from Microsoft products to Incidents, we use the standard schema of Microsoft alerts to map automatically a large number of entities. Those are not exposed in the incident page today, but are used for investigation and you have experiences.
~ Ofer