Expanding entities on investigation map

%3CLINGO-SUB%20id%3D%22lingo-sub-1626037%22%20slang%3D%22en-US%22%3EExpanding%20entities%20on%20investigation%20map%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1626037%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20seems%20simple%20but%20it's%20driving%20me%20nuts.%3CBR%20%2F%3E%3CBR%20%2F%3EHow%20do%20I%20expand%20something%20like%20this%20on%20the%20investigation%20map%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22MichaelBuz_0-1598988013663.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F215905i2DD47E8509DF45BC%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22MichaelBuz_0-1598988013663.png%22%20alt%3D%22MichaelBuz_0-1598988013663.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EWhen%20I%20click%20it%2C%20it%20takes%20me%20to%20the%20raw%20logs%2Fevents.%20I%20want%20to%20see%20all%209%20(or%20whatever%20the%20number%20happens%20to%20be)%20on%20the%20investigation%20map%2C%20not%20raw%20log%20info.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1627496%22%20slang%3D%22en-US%22%3ERe%3A%20Expanding%20entities%20on%20investigation%20map%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1627496%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F778599%22%20target%3D%22_blank%22%3E%40MichaelBuz%3C%2FA%3E%26nbsp%3BThat%20is%20not%20possible%20right%20now.%26nbsp%3B%20You%20can%20enter%20feedback%20to%20request%20it%20starts%20to%20work%20that%20way%20at%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ffeedback.azure.com%2Fforums%2F920458-azure-sentinel%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Ffeedback.azure.com%2Fforums%2F920458-azure-sentinel%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

This seems simple but it's driving me nuts.

How do I expand something like this on the investigation map

MichaelBuz_0-1598988013663.png

When I click it, it takes me to the raw logs/events. I want to see all 9 (or whatever the number happens to be) on the investigation map, not raw log info.

1 Reply

@MichaelBuz That is not possible right now.  You can enter feedback to request it starts to work that way at: https://feedback.azure.com/forums/920458-azure-sentinel