Overview of the Entity behavior page

There are a few ways to get to the Entity behavior page:

• When looking at the Entities tab of the incident's View full details page
• When looking at a specific entity's information on the incident graphical investigation screen and then clicking on the View full details button
• Selecting the Entity behavior link via the Microsoft Sentinel navigation menu

The main difference between these three ways is that the first two will take you directly to the entity's details page, while the third will take you to the main screen of Entity behavior, as shown in the following screenshot. Note that some of the white space on the screen has been removed:

Figure 10.3 – Entity behavior main screen

Note

At the time of writing, only the Account, Hosts, and IP Address entity types can be viewed on the Entity behavior screen. Others may be added in the future.

Let's look at each of these...