Question

Your SOC team built a scheduled analytics rule in Microsoft Sentinel that queries a custom firewall table and generates alerts for repeated blocked outbound connections. Analysts complain that the resulting incidents show no clickable entities, so they cannot pivot on the source host or user, and the investigation graph is empty. The KQL query already returns columns named SrcHostName, SrcUserName, and SrcIP. What should you configure on the rule to resolve this?

Accepted Answer

Add entity mappings in the rule that map the Host, Account, and IP entity types to the SrcHostName, SrcUserName, and SrcIP columns.

Answer

Enable UEBA on the workspace so Sentinel automatically enriches the custom firewall table with entity information.

Answer

Create an automation rule that runs a playbook to populate the incident entities after the alert fires.

Answer

Switch the rule from scheduled to NRT so entities are extracted in near-real-time during ingestion.