Microsoft Sentinel Entity mapping.

Copper Contributor

Hi,

After new version of Microsoft Sentinel entity mapping while deploying rules, we need to do entity mapping manually. Before we use to define custom entity in the rules itself. Through new version we can map different type of entity but it's a manual work, if there are anyway that mapping, we can do through rules itself or sentinel have any feature to pick the entity by itself.

 

Manual entity mapping it's a painful job while deploying 200+ rules to new workspaces.

 

 

1 Reply

Hey @shamiths 

 

Have you looked at the "custom details" section and also the "Sentinel Entities" under Entity Mapping

 

This should give you what you require

 

Documentation Link here