Skip to content

Update Entity Analyzer: intelligent user identifier detection#13614

Open
Yaniv-Shasha wants to merge 1 commit intoAzure:masterfrom
Yaniv-Shasha:update-entity-analyzer-user-identifier
Open

Update Entity Analyzer: intelligent user identifier detection#13614
Yaniv-Shasha wants to merge 1 commit intoAzure:masterfrom
Yaniv-Shasha:update-entity-analyzer-user-identifier

Conversation

@Yaniv-Shasha
Copy link
Contributor

Proposed Changes

This PR updates the Incident-Trigger-Entity-Analyzer playbook (azuredeploy.json) with the following improvements:

What Changed

Area Change
description Extended: includes "intelligent user identifier detection supporting objectGuid, aadUserId, UPN, and Name+UPNSuffix"
lastUpdateTime Updated to 2026-02-10
author.name Fixed casing to Yaniv Shasha
Logic App tags Added hidden-SentinelTemplateName and hidden-SentinelTemplateVersion: 2.0
User loop logic Added Condition_-_Check_Valid_User_Identifier with coalesce() across objectGuid, aadUserId, UPN (both casings), and Name+UPNSuffix
Else branch Added Add_Skip_comment_to_incident when no valid user identifier exists
API ID casing Standardized to azuresentinel (lowercase)
Comment HTML Cleaner formatting

Why

Previously the playbook only used AadUserId to identify users. Many Sentinel incidents provide user entities with different identifier types (objectGuid, UPN, Name+UPNSuffix), causing silent failures. This update ensures robust user resolution across all common identifier formats.

…jectGuid, aadUserId, UPN, and Name+UPNSuffix support
@Yaniv-Shasha Yaniv-Shasha requested review from a team as code owners February 11, 2026 03:10
@v-shukore v-shukore self-assigned this Feb 11, 2026
@v-shukore v-shukore added the Solution Solution specialty review needed label Feb 11, 2026
@v-shukore
Copy link
Contributor

@v-shukore
Copy link
Contributor

Hi @Yaniv-Shasha, any update on the above comment. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Solution Solution specialty review needed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Comments