Entities are the objects which form the basis of the security events.
From the Cases page, click on an entity to be redirected to the Entity Explorer page.
The Entity Explorer page gives you insight into:
The number of and specific cases this entity was involved with during the last three months. This provides information about the entity throughout the cases in the system. This explains why the information presented here might be different from the information you see for a specific entity in the side drawer. For example, a URL where is suspicious = true and is highlighted in red in the side drawer, might appear here as false if this same URL is defined according to different criteria in a few other cases.
The details about the entity including basic information and enrichment information gathered about this entity from different cases
The linked entities such as users and IP addresses
The frequency of each type of case
A list of log entries
You can expand or contract of each category by clicking the arrow at the right side of the category name (Entity, Default, etc.).
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-03-06 UTC."],[[["The Entity Explorer page provides a comprehensive view of an entity's involvement in security cases within the last three months."],["This page displays details about an entity, including basic and enriched information gathered from various cases."],["You can see linked entities, such as users and IP addresses, associated with the selected entity."],["The Entity Explorer shows the frequency of each type of case the entity has been involved in, along with a list of associated log entries."]]],[]]
