This can be done in a few ways, but here is my first impression
The entity should be mapped to a UID/programmatic name (like email, or FQ), as this is what Actions work on.
To get more interesting information you "add enrichment" that pulls additional fields from the ingested Alert and adds as sub attributes:
Cases > Alert > Events tab > Event > gear symbol > Mapping > Entity type > three dots > Add Enrichment
This way makes full use of the great info that comes in the original packet
To show this data, focus on the Entities highlights' widget, click 'View Details' and Add to highlight
Alternatively you can use playbook logic to enrich usernames to get more 'friendly' info (display name, managers name etc). This would be in the vendor predefined widget you add to the playbook view.
HTH Andy
This can be done in a few ways, but here is my first impression
The entity should be mapped to a UID/programmatic name (like email, or FQ), as this is what Actions work on.
To get more interesting information you "add enrichment" that pulls additional fields from the ingested Alert and adds as sub attributes:
Cases > Alert > Events tab > Event > gear symbol > Mapping > Entity type > three dots > Add Enrichment
This way makes full use of the great info that comes in the original packet
To show this data, focus on the Entities highlights' widget, click 'View Details' and Add to highlight
Alternatively you can use playbook logic to enrich usernames to get more 'friendly' info (display name, managers name etc). This would be in the vendor predefined widget you add to the playbook view.
HTH Andy
Perfect, thank you. Got it!
