Entities missing in Incidents

[Sidra_Raza]

Hello,

Entities are not showing on any of the incidents in Sentinel. Although, I have mapped the entities correctly for each alert. 

I have the same alerts and entities mapping on other tenant and it shows entities there. What could be the issue?

Update: I raised the support ticket to microsoft.

Issue has been resolved by Microsoft. It was a misconfiguration from the backend.

[#2]

@Sidra_Raza Hi , can you check in your sentinel settings if the below settings is enabled 

Identify advanced threats with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Mic...

[#3]

It's enabled already but no luck.

[#4]

@Sidra_Raza for this analytic rule the entity mapping should look like the below 

[#5]

Hi Sidra, this sounds like an issue we had last year with the old queries. I would first, make sure that you are using the latest version of the analytic rule. If you are not, it may be related to this: https://learn.microsoft.com/en-us/azure/sentinel/whats-new#account-enrichment-fields-removed-from-az...

[#6]

I did the same mappings

[#7]

Could you please revisit the same incidents after some time as the Entity mapping takes a while to populate.

[#8]

It's been more than 10 days when I did the mapping of entities.

[#9]

Following this thread since we are facing a similar issues with few analytics .

[#10]

I'm following/bumping this because we have the same thing, sort of. Sentinel can stop parsing entities for 1-2 hours and then suddenly start again. Playbooks and automation rules get proper data from the incidents but no entities are displayed in the incident.

[#11]

Please share me ticket numner.