This table lists the current entity info lists that have been configured. These entity info lists can be used to filter events on when creating an event bucket.
To the right of each list is a set of three buttons. The first button allows you to view the full list of all the items currently in the entity info list. From this page, you can also add and remove items.
The second button allows you to edit the description and lookup type of the entity info the list. The last button will delete the entire entity info list.
Though entity lists can be created by adding each value individually, the easiest way to create an entity list is to import a .csv file.
When creating an entity info list, start by giving it a name and description.
This file contains two columns: Operation and Description. The operation column contains the administrative operations associated with this rule. The description column contains a short description of what the operation indicates.
The O365_Administrative_Operations entity list created in the last step is used with the O365_Administrative_Operations event bucket.
To use this entity list, click +FILTER. Select entityinfo from the Filter Type dropdown menu. We want to match the values in this list to the @fields.Operation field, so select this field from the dropdown menu above.
Lastly, in the Match Entities box, select the O365_Administrative_Operations entity list that was created earlier. Click "SAVE" to save this filter.