Merge pull request #277667 from yelevin/patch-2

Refining note about entity mapping

Author: prmerger-automator[bot]

articles/sentinel/entities-reference.md

@@ -4,22 +4,24 @@ description: This article displays the Microsoft Sentinel entity types and their
 author: yelevin
 ms.author: yelevin
 ms.topic: reference
-ms.date: 10/15/2023
+ms.date: 06/09/2024
 ---
 
 # Microsoft Sentinel entity types reference
 
-This document contains two sets of information regarding entities and entity types in Microsoft Sentinel.
-- The [**Entity types and identifiers**](#entity-types-and-identifiers) table shows the different types of entities that can be used in [entity mapping](map-data-fields-to-entities.md) in both [analytics rules](detect-threats-custom.md) and [hunting](hunting.md). The table also shows, for each entity type, the different identifiers that can be used to identify an entity.
-- The [**Entity schema**](#entity-type-schemas) section shows the data structure and schema for entities in general and for each entity type in particular, including some types that are not represented in the entity mapping feature.
+This document contains two sets of information regarding entities and entity types in Microsoft Sentinel and the [Microsoft unified security operations platform](microsoft-sentinel-defender-portal.md).
+- The [**Entity types and identifiers**](#entity-types-and-identifiers) table shows the different types of [entities](entities.md) that can be identified in alerts and incidents, allowing you to [track and investigate them](entity-pages.md). The table also shows, for each entity type, the different identifiers that can be used to identify an entity.
+- The [**Entity schema**](#entity-type-schemas) section shows the data structure and schema for entities in general and for each entity type in particular.
+
+[!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
 
 ## Entity types and identifiers
 
-The following table shows the **entity types** currently available for mapping in Microsoft Sentinel, and the **attributes** available as **identifiers** for each entity type. Nearly all of these attributes appear in the **Identifiers** drop-down list in the [entity mapping](map-data-fields-to-entities.md) section of the [analytics rule wizard](detect-threats-custom.md) (see footnotes for exceptions).
+The following table shows the **entity types** that can be recognized by Microsoft Sentinel, and the **attributes** that can be used as **identifiers** for each entity type.
 
-You can use up to three identifiers for a single entity mapping. **Strong identifiers** alone are sufficient to uniquely identify an entity, whereas **weak identifiers** can do so only in combination with other identifiers.
+Microsoft Sentinel recognizes entities in alerts and incidents that are created by [entity mapping](map-data-fields-to-entities.md) in [analytics rules](threat-detection.md). It also recognizes entities already identified in alerts ingested from other sources.
 
-Learn more about [strong and weak identifiers](entities.md#strong-and-weak-identifiers).
+You can currently use up to three identifiers for a given entity when creating an entity mapping in Microsoft Sentinel. **Strong identifiers** alone are sufficient to uniquely identify an entity, whereas **weak identifiers** can do so only in combination with other identifiers. Learn more about [strong and weak identifiers](entities.md#strong-and-weak-identifiers). Most but not all identifiers in this table can be used when creating entity mappings in Microsoft Sentinel (see footnotes).
 
 | Entity type | Identifiers | Strong identifiers | Weak identifiers |
 | - | - | - | - |