Entities missing in Incidents

Brass Contributor


Entities are not showing on any of the incidents in Sentinel. Although, I have mapped the entities correctly for each alert. 



I have the same alerts and entities mapping on other tenant and it shows entities there. What could be the issue?


Update: I raised the support ticket to microsoft.

Issue has been resolved by Microsoft. It was a misconfiguration from the backend.


10 Replies

@Sidra_Raza Hi , can you check in your sentinel settings if the below settings is enabled 

Identify advanced threats with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Mic...




It's enabled already but no luck.

@Sidra_Raza for this analytic rule the entity mapping should look like the below 



Hi Sidra, this sounds like an issue we had last year with the old queries. I would first, make sure that you are using the latest version of the analytic rule. If you are not, it may be related to this: https://learn.microsoft.com/en-us/azure/sentinel/whats-new#account-enrichment-fields-removed-from-az...
I did the same mappings
Could you please revisit the same incidents after some time as the Entity mapping takes a while to populate.
It's been more than 10 days when I did the mapping of entities.
Following this thread since we are facing a similar issues with few analytics .
I'm following/bumping this because we have the same thing, sort of. Sentinel can stop parsing entities for 1-2 hours and then suddenly start again. Playbooks and automation rules get proper data from the incidents but no entities are displayed in the incident.
Please share me ticket numner.