Skip to main content
Solved

Mapping alerts correctly

  • May 2, 2025
  • 2 replies
  • 19 views
MikelSA
Forum|alt.badge.img+8

Hi, How are you doing?

I've been having problems with the mapping for this 

It is supposed to come from AzureAD IdentityProtection, but at the moment i cant get to map any Entities Highlights for Default, only the IP.

The name of the user comes in the "aaduserid" variable, but I want the alert to show the user's email address or display name as an entity — something more useful.

Any solutions? I came with the solution to do some KQL querys, get the json, en enricht the entities, but im sure that im missing something.

Thanks!

Best answer by SoarAndy

This can be done in a few ways, but here is my first impression

The entity should be mapped to a UID/programmatic name (like email, or FQ), as this is what Actions work on. 

To get more interesting information you "add enrichment" that pulls additional fields from the ingested Alert and adds as sub attributes:
Cases > Alert > Events tab > Event > gear symbol > Mapping > Entity type > three dots > Add Enrichment
This way makes full use of the great info that comes in the original packet

To show this data, focus on the Entities highlights' widget, click 'View Details' and Add to highlight

 

Alternatively you can use playbook logic to enrich usernames to get more 'friendly' info (display name, managers name etc).  This would be in the vendor predefined widget you add to the playbook view.

HTH Andy

 

 

 

2 replies

SoarAndy
Staff
Forum|alt.badge.img+12
  • SoarAndy
  • Staff
  • Answer
  • May 2, 2025

This can be done in a few ways, but here is my first impression

The entity should be mapped to a UID/programmatic name (like email, or FQ), as this is what Actions work on. 

To get more interesting information you "add enrichment" that pulls additional fields from the ingested Alert and adds as sub attributes:
Cases > Alert > Events tab > Event > gear symbol > Mapping > Entity type > three dots > Add Enrichment
This way makes full use of the great info that comes in the original packet

To show this data, focus on the Entities highlights' widget, click 'View Details' and Add to highlight

 

Alternatively you can use playbook logic to enrich usernames to get more 'friendly' info (display name, managers name etc).  This would be in the vendor predefined widget you add to the playbook view.

HTH Andy

 

 

 

MikelSA
Forum|alt.badge.img+8
  • MikelSABronze 2
  • Author
  • Bronze 2
  • May 2, 2025

This can be done in a few ways, but here is my first impression

The entity should be mapped to a UID/programmatic name (like email, or FQ), as this is what Actions work on. 

To get more interesting information you "add enrichment" that pulls additional fields from the ingested Alert and adds as sub attributes:
Cases > Alert > Events tab > Event > gear symbol > Mapping > Entity type > three dots > Add Enrichment
This way makes full use of the great info that comes in the original packet

To show this data, focus on the Entities highlights' widget, click 'View Details' and Add to highlight

 

Alternatively you can use playbook logic to enrich usernames to get more 'friendly' info (display name, managers name etc).  This would be in the vendor predefined widget you add to the playbook view.

HTH Andy

 

 

 


Perfect, thank you. Got it!

Terms & ConditionsCookie settingsAccessibility statement
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.