Summary

In this chapter, you learned how to activate and configure Microsoft Sentinel's Entity behavior functionality. You learned how to view information when looking at an entity and the different ways to find the entities to view. You also learned how to write activities to use in your investigations.

With what you have learned, you can now perform investigations using entities quickly and easily. You can use the out-of-the-box activities, plus the ones you have written, to get detailed information about your entities.

In the next chapter, you will learn about the operational tasks you must perform to keep your Microsoft Sentinel instance running smoothly.