Microsoft Sentinel Entity mapping.

Copper Contributor


After new version of Microsoft Sentinel entity mapping while deploying rules, we need to do entity mapping manually. Before we use to define custom entity in the rules itself. Through new version we can map different type of entity but it's a manual work, if there are anyway that mapping, we can do through rules itself or sentinel have any feature to pick the entity by itself.


Manual entity mapping it's a painful job while deploying 200+ rules to new workspaces.



1 Reply

Hey @shamiths 


Have you looked at the "custom details" section and also the "Sentinel Entities" under Entity Mapping


This should give you what you require


Documentation Link here