Intermittent Entity mapping from Defender Incidents

[ish-rafaeldamiani]

Describe the bug
Incidents created in Microsoft Defender will not always have their entities mapped in Sentinel. Entities don't appear on the incident analysis screen or via KQL query.

To Reproduce
Steps to reproduce the behavior:

1. Click on the Incidents menu and select an incident originating from Defender
2. When previewing the incident or clicking View Full Details, entities aren't displayed

Expected behavior
The entities (user, ip, host, etc.) will be displayed in all incidents.

Screenshots
Prints of incidents without entities and executing the query by clicking on the System Alert ID link

Additional context
As shown in the prints, some incidents originating from Defender are sent via data connector without the entities. Even running a query searching for the title or system alert id, the information is not found.

[v-rusraut]

Hi @ish-rafaeldamiani,
Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 01 May 2024. Thanks!

[v-rusraut]

Hi @ish-rafaeldamiani,

• Please help us to understand from which source you are getting incident - Sentinel or Defender portal
• If from sentinel then which Analytical Rule you are using here and also confirm that in Entity mapping section have you added any entity, please refer below screen shot.

• If from defender endpoint please check entities are already available in defender portal itself.

Thanks

[ish-rafaeldamiani]

Hi, @v-rusraut

If you look at the first print it has Alert products names: Microsoft Defender for Cloud. This behavior occurs with incidents originating from Defender (for cloud, endpoint, office365).

There is no occurrence with incidents originating from Analytics Rules.

Entities can be located in the Defender portal. But the problem in this case is that some SOC analysts are not allowed access to the Defender portal.

What do I need to know if this behavior of entities is not sent from the Defender portal to Sentinel. Is it normal or possible bug?

[v-rusraut]

Hi @ish-rafaeldamiani,
We are working with respective team, we will update you.
Thanks

[v-rusraut]

Hi @ish-rafaeldamiani,
We are waiting for response from respective team, we will update you.
Thanks

[v-rusraut]

Hi @ish-rafaeldamiani,
Still waiting for response from respective team, we will update you.
Thanks