Cannot get 'Entities' via a custom analytic rule.

%3CLINGO-SUB%20id%3D%22lingo-sub-2359732%22%20slang%3D%22en-US%22%3ECannot%20get%20'Entities'%20via%20a%20custom%20analytic%20rule.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2359732%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20folks%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20trying%20to%20write%20an%20analytic%20rule%20to%20get%20all%20the%20alerts%20from%20'Microsoft%20365%20Security'%20center%20and%20generate%20incidents%20based%20on%20those%20alerts%20in%20Sentinel.%3C%2FP%3E%3CP%3EAll%20that%20the%20rule%20is%20lacking%20is%20that%20I%20get%20the%20'Entities'%20tab%20empty%20when%20an%20incident%20is%20made.%3C%2FP%3E%3CP%3ECan%20anybody%20help%20me%20out%20if%20possible%20with%20an%20KQL%20command%20to%20add%2Fget%20the%20entities%20part%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWould%20really%20appreciate%20the%20help.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2359904%22%20slang%3D%22en-US%22%3ERe%3A%20Cannot%20get%20'Entities'%20via%20a%20custom%20analytic%20rule.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2359904%22%20slang%3D%22en-US%22%3EHave%20you%20mapped%20the%20Entity%20in%20your%20KQL%3F%20See%20example%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Fblob%2F06832a873e1686244f0bc02b10f79ba879078864%2FDetections%2FMultipleDataSources%2FPotentialBuildProcessCompromiseMDE.yaml%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Fblob%2F06832a873e1686244f0bc02b10f79ba879078864%2FDetections%2FMultipleDataSources%2FPotentialBuildProcessCompromiseMDE.yaml%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20last%20line%2C%20maps%20the%20Host%20(entity)%20to%20the%20DeviceName%20column%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%20%7C%20extend%20HostCustomEntity%3DDeviceName%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20new%2C%20Alert%20enrichment%20(Preview)%20allows%20you%20to%20create%20Entity%20Mapping%20from%20the%20UI%20and%20these%20work%20but%20don't%20appear%20in%20the%20KQL%20%2F%20rule%20logic%20-%20see%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-gb%2Fazure%2Fsentinel%2Fmap-data-fields-to-entities%23notes-on-the-new-version%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-gb%2Fazure%2Fsentinel%2Fmap-data-fields-to-entities%23notes-on-the-new-version%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2360836%22%20slang%3D%22en-US%22%3ERe%3A%20Cannot%20get%20'Entities'%20via%20a%20custom%20analytic%20rule.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2360836%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3BThanks%20for%20the%20reply%2C%20but%20this%20does%20not%20work.%20It%20throws%20the%20error%3A%3C%2FP%3E%3CP%3EThe%20name%20'entityMappings'%20does%20not%20refer%20to%20any%20known%20column%2C%20table%2C%20variable%20or%20function.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2361011%22%20slang%3D%22en-US%22%3ERe%3A%20Cannot%20get%20'Entities'%20via%20a%20custom%20analytic%20rule.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2361011%22%20slang%3D%22en-US%22%3ESorry%20that%20was%20just%20an%20example%2C%20you%20may%20prefer%20to%20use%20the%20UI%20option%20or%20you%20need%20to%20replace%3A%20%3CBR%20%2F%3E%3CBR%20%2F%3E%3CDEVICENAME%3E%20with%20a%20valid%20column%20that%20you%20have%20in%20your%20system.%20As%20you%20haven't%20shared%20any%20syntax%2C%20its%20hard%20to%20guess%20at%20what%20entity%20you%20are%20trying%20to%20map.%20If%20its%20an%20%22Account%22%20for%20example%20you%20may%20need%20%3CBR%20%2F%3E%3CBR%20%2F%3E%7C%20extend%20AccountCustomEntity%3D%26lt%3B%20your%20account%20name%20column%20%26gt%3B%3CBR%20%2F%3E%3CBR%20%2F%3Emaybe%20username%20or%20AccountCustomEntity%20%3D%20UserPrincipalName%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Fblob%2F06832a873e1686244f0bc02b10f79ba879078864%2FDetections%2FMultipleDataSources%2FIridiumIOCs.yaml%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Fblob%2F06832a873e1686244f0bc02b10f79ba879078864%2FDetections%2FMultipleDataSources%2FIridiumIOCs.yaml%3C%2FA%3E%3C%2FDEVICENAME%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2361453%22%20slang%3D%22en-US%22%3ERe%3A%20Cannot%20get%20'Entities'%20via%20a%20custom%20analytic%20rule.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2361453%22%20slang%3D%22en-US%22%3ESorry%2C%20I%20was%20not%20able%20to%20interpret%20that.%3CBR%20%2F%3ESo%20what%20I%20am%20doing%20is%20I%20have%20created%20a%20logic%20app%20for%20ingesting%20the%20Office%20365%20alerts%20via%20Graph%20Security%20API%20and%20then%20I%20am%20storing%20the%20results%20in%20a%20custom%20table%20called%20'OfficeAlerts_LogicApp_CL'%3CBR%20%2F%3E%3CBR%20%2F%3EThen%20I%20am%20trying%20to%20call%20that%20table%20using%20KQL%20to%20make%20incidents%20from%20the%20alerts%20in%20that%20table.%3CBR%20%2F%3EMy%20query%20is%20as%20below%20%3A%3CBR%20%2F%3E%3CBR%20%2F%3EOfficeAlerts_LogicApp_CL%3CBR%20%2F%3E%7C%20where%20parse_json(comments_s)%5B0%5D%20%3D%3D%20%22New%20alert%22%3CBR%20%2F%3E%7C%20where%20vendorInformation_provider_s%20%3D%3D%20%22Office%20365%20Security%20and%20Compliance%22%3CBR%20%2F%3E%7C%20where%20parse_json(userStates_s)%5B0%5D.domainName%20%3D%3D%20%22%22%3CBR%20%2F%3E%3CBR%20%2F%3EI%20think%20maybe%20the%20problem%20is%20that%20the%20output%20is%20in%20pure%20'json'%20and%20I%20am%20not%20able%20to%20parse%2Fstructure%20it%20so%20that%20I%20can%20get%20the%20entities%20in%20the%20incident.%3CBR%20%2F%3ECan%20you%20suggest%20something%20that%20as%20per%20this%20situation%20please%3F%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hello folks,

 

I am trying to write an analytic rule to get all the alerts from 'Microsoft 365 Security' center and generate incidents based on those alerts in Sentinel.

All that the rule is lacking is that I get the 'Entities' tab empty when an incident is made.

Can anybody help me out if possible with an KQL command to add/get the entities part?

 

Would really appreciate the help.

4 Replies
Have you mapped the Entity in your KQL? See example

https://github.com/Azure/Azure-Sentinel/blob/06832a873e1686244f0bc02b10f79ba879078864/Detections/Mul...

The last line, maps the Host (entity) to the DeviceName column:

| extend HostCustomEntity=DeviceName

The new, Alert enrichment (Preview) allows you to create Entity Mapping from the UI and these work but don't appear in the KQL / rule logic - see https://docs.microsoft.com/en-gb/azure/sentinel/map-data-fields-to-entities#notes-on-the-new-version

@Clive Watson Thanks for the reply, but this does not work. It throws the error:

The name 'entityMappings' does not refer to any known column, table, variable or function.

Sorry that was just an example, you may prefer to use the UI option or you need to replace:

<DeviceName> with a valid column that you have in your system. As you haven't shared any syntax, its hard to guess at what entity you are trying to map. If its an "Account" for example you may need

| extend AccountCustomEntity=< your account name column >

maybe username or AccountCustomEntity = UserPrincipalName

https://github.com/Azure/Azure-Sentinel/blob/06832a873e1686244f0bc02b10f79ba879078864/Detections/Mul...
Sorry, I was not able to interpret that.
So what I am doing is I have created a logic app for ingesting the Office 365 alerts via Graph Security API and then I am storing the results in a custom table called 'OfficeAlerts_LogicApp_CL'

Then I am trying to call that table using KQL to make incidents from the alerts in that table.
My query is as below :

OfficeAlerts_LogicApp_CL
| where parse_json(comments_s)[0] == "New alert"
| where vendorInformation_provider_s == "Office 365 Security and Compliance"
| where parse_json(userStates_s)[0].domainName == ""

I think maybe the problem is that the output is in pure 'json' and I am not able to parse/structure it so that I can get the entities in the incident.
Can you suggest something that as per this situation please?