Work with entity delimiters
Entity delimiters let you decide for each entity type and data source how you want to map the incoming entity. You can disable delimiters for incoming entities, map a specific delimiter (up to 64 characters) or use a regular expression instead.
For example, if you have several files separated by commas in a single entity, you can set the delimiter to a comma so the system treats each file as a separate entity.
You can use entity delimiters in two places:
- On the Event Configuration > Mapping page.
- On the Playbook action > Siemplify > Create Entity page.
Event configuration & mapping
The Event Configuration feature lets you assign visual families to events, providing a graphic visualization of their relationships with other actions. This process ensures events are correctly categorized and contain accurate and complete information. For details, see configure mapping and assign visual families.
Need more help? Get answers from Community members and Google SecOps professionals.