LinkedIn
Twitter
Hi, How are you doing?
I've been having problems with the mapping for this
It is supposed to come from AzureAD IdentityProtection, but at the moment i cant get to map any Entities Highlights for Default, only the IP.
The name of the user comes in the "aaduserid" variable, but I want the alert to show the user's email address or display name as an entity โ something more useful.
Any solutions? I came with the solution to do some KQL querys, get the json, en enricht the entities, but im sure that im missing something.
Thanks!
Solved
1 ACCEPTED SOLUTION
This can be done in a few ways, but here is my first impression
The entity should be mapped to a UID/programmatic name (like email, or FQ), as this is what Actions work on.
To get more interesting information you "add enrichment" that pulls additional fields from the ingested Alert and adds as sub attributes:
Cases > Alert > Events tab > Event > gear symbol > Mapping > Entity type > three dots > Add Enrichment
This way makes full use of the great info that comes in the original packet
To show this data, focus on the Entities highlights' widget, click 'View Details' and Add to highlight
Alternatively you can use playbook logic to enrich usernames to get more 'friendly' info (display name, managers name etc). This would be in the vendor predefined widget you add to the playbook view.
HTH Andy
This can be done in a few ways, but here is my first impression
The entity should be mapped to a UID/programmatic name (like email, or FQ), as this is what Actions work on.
To get more interesting information you "add enrichment" that pulls additional fields from the ingested Alert and adds as sub attributes:
Cases > Alert > Events tab > Event > gear symbol > Mapping > Entity type > three dots > Add Enrichment
This way makes full use of the great info that comes in the original packet
To show this data, focus on the Entities highlights' widget, click 'View Details' and Add to highlight
Alternatively you can use playbook logic to enrich usernames to get more 'friendly' info (display name, managers name etc). This would be in the vendor predefined widget you add to the playbook view.
HTH Andy
