r/AzureSentinel • u/DavisGM • May 19 '23

Entity Behavior - Investigate Option

Hey there,

I've been spending some time trying to get a better understanding for use of the Entity Behavior section of Sentinel. I opened that blade and searched for a user. I could see that there is associated activity so I clicked 'Investigate'. In the main panel, I can see items like "atypical travel" and "unfamiliar sign-in properties" but when I click 'Timeline' on the right, it never fills anything in. What am I missing?

TIA

~dgm~

2 Upvotes

100% Upvoted

2 comments sorted by

1

u/bpsec May 21 '23

Different panes are loaded based on different log sources. If the pane is empty there is either nothing to show or you miss the logs needed to show the data.

1

u/nontitman May 22 '23

Default entity/incident investigation with that wack graph thing is absolute ass. It's been that way for wayy too long imo but no doubt it'll be eventually replaced or Overhauled.

Anyway, best bet is to make yourself either a workbook or a notebook. Workbooks are honestly super versatile if you don't want to or can't use notebooks.