Investigations - Investigation cannot be used to investigate this incident because of an error.

Hi,

I'm really sorry for the newbie comment, but I have both template Analytic rules and my own Analytic rules and map identities to allow the investigation function to work, but I get an error

Investigation cannot be used to investigate this incident because of an error, please try again later.

I'm scratching my head as to what is not working here, even considering rebuilding our Sentinel environment.

My example

SecurityEvent
| where EventID == "4688"
| where Process == "cscript.exe"
|project StartTimeUtc = TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName
| extend timestamp = StartTimeUtc, AccountCustomEntity = Account, HostCustomEntity = Computer

and I have mapped the fields shown.

Please could anybody kindly help?