Skip to content

Commit 84c8d55

Browse files
committed
Cleanup
1 parent c693376 commit 84c8d55

File tree

2 files changed

+3
-1
lines changed

2 files changed

+3
-1
lines changed

articles/sentinel/entities.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,8 @@ Entity pages are designed to be part of multiple usage scenarios, and can be acc
124124

125125
:::image type="content" source="./media/identify-threats-with-entity-behavior-analytics/entity-pages-use-cases.png" alt-text="Entity page use cases":::
126126

127+
Entity page information is stored in the **BehaviorAnalytics** table, described in detail in the [Microsoft Sentinel UEBA enrichments reference](ueba-enrichments.md).
128+
127129
## Next steps
128130

129131
In this document, you learned about working with entities in Microsoft Sentinel. For practical guidance on implementation, and to use the insights you've gained, see the following articles:

articles/sentinel/whats-new.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ In addition to the native experience in the Microsoft 365 Defender Portal, custo
5757

5858
### Incident update trigger for automation rules (Preview)
5959

60-
Automation rules are an essential tool for triaging your incidents queue, reducing the noise in it, and generally coping with the high volume of incidents seamlessly and transparently. Until today you could create and run automation rules and playbooks that would run upon the creation of an incident, but your automation options were more limited past that point in the incident lifecycle.
60+
Automation rules are an essential tool for triaging your incidents queue, reducing the noise in it, and generally coping with the high volume of incidents in your SOC seamlessly and transparently. Previously you could create and run automation rules and playbooks that would run upon the creation of an incident, but your automation options were more limited past that point in the incident lifecycle.
6161

6262
You can now create automation rules and playbooks that will run when incident fields are modified - for example, when an owner is assigned, when its status or severity is changed, or when alerts and comments are added.
6363

0 commit comments

Comments
 (0)