Skip to content

Commit c22030c

Browse files
author
your name
committed
Common account name warning
1 parent ea7d693 commit c22030c

File tree

1 file changed

+16
-2
lines changed

1 file changed

+16
-2
lines changed

articles/sentinel/entities-reference.md

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
title: Microsoft Sentinel entity types reference | Microsoft Docs
33
description: This article displays the Microsoft Sentinel entity types and their required identifiers.
44
author: yelevin
5-
ms.topic: reference
6-
ms.date: 07/06/2022
75
ms.author: yelevin
6+
ms.topic: reference
7+
ms.date: 05/29/2023
88
ms.custom: ignite-fall-2021
99
---
1010

@@ -85,6 +85,20 @@ Weak identifiers of an account entity:
8585

8686
- Name
8787

88+
> [!NOTE]
89+
> If the **Account** entity is defined using the **Name** identifier, and the Name value of a particular entity is one of the following generic, commonly built-in account names, then that entity will be dropped from its alert.
90+
> - ADMIN
91+
> - ADMINISTRATOR
92+
> - SYSTEM
93+
> - ROOT
94+
> - ANONYMOUS
95+
> - AUTHENTICATED USER
96+
> - NETWORK
97+
> - NULL
98+
> - LOCAL SYSTEM
99+
> - LOCALSYSTEM
100+
> - NETWORK SERVICE
101+
88102
## Host
89103

90104
| Field | Type | Description |

0 commit comments

Comments
 (0)