Entity Panel
The Entity Panel provides contextual information about specific identifiers, known as entities. The entities currently supported are IP addresses and domains. Entities are extracted from event data and stored in their own data store. The Entity Panel displays all contextual information collected for an entity, drawing data from both within and outside the network.
This topic contains the following information:
- Accessing the Entity Panel
- Entity information tabs
- Adding annotations
- Viewing malicious files
- Date ranges
Click the pin icon to keep the Entity Panel open and visible when navigating to other pages where it is available.
Accessing the Entity Panel
To access the Entity Panel:
- Left-click any entity (such as an IP address) anywhere in the portal.
- Click an IP address in the detector details tabs.
- Click View Device Details in the Actions menu.
- Click a device IP in the High Risk Devices dashboard widget.
- Click the IP label on the Detections Device Timeline.
Entity information tabs
The tabs on the right side of the panel display contextual and activity information, along with external threat intelligence and enrichment details.
|
Tab |
Description |
|---|---|
|
Summary |
This tab displays timestamps for when the entity was first and last seen, applied tags, and a summary of records found in other tabs. The summary also includes a button to initiate immediate response actions, such as Contain, Isolate, or Ban an endpoint. |
|
VirusTotal |
Contains details from the FortiNDR Cloud integration with VirusTotal, including information on Detected URLs, Resolved URLs (passive DNS resolution), and hashes of files (Communicating, Downloaded, or Referrer Samples) related to the entity. |
|
Crowdstrike |
This tab appears when the Crowdstrike integration is enabled. For more information see, CrowdStrike Falcon integration for FortiNDR Cloud. |
|
Fortinet Automation Service |
This tab appears when the Fortinet Automation Service is provisioned. See, Fortinet Automation Service . |
|
FortiEDR |
This tab appears when the FortiEDR integration is enabled. For more information see, FortiEDR integration for FortiNDR Cloud. |
|
FortiManager |
This tab appears when the FortiManager integration is enabled. For more information see, FortiNDR Cloud for FortiManager. |
|
PDNS (Passive DNS) |
Displays all passive DNS records observed for the entity for the entire life of the account. |
|
Detections |
Lists all Active detections associated with the entity within the selected time range, along with their Last Seen and Created dates. This allows analysts to quickly view specific threats targeting that entity. |
|
Observations |
Displays a list of any Behavioral Observations associated with the entity. Behavioral Observations offer context for threat hunting and investigating network activities. Clicking an observation title opens the Observation Details page. See Behavioral observations. |
|
DHCP |
Displays all DHCP records for the entity for the life of the account. |
|
Accounts |
Shows Kerberos and NTLM records observed for the entity over the past 30 days. This is useful for identifying the users of an internal asset. |
|
Software |
Lists all software associated with the entity, observed from any network protocol. |
|
FortiGuard |
Indicates if a malicious file is detected with the message File identified as malicious and provides a hyperlink to view attributes about the malicious file. |
|
WHOIS |
Provides registration information populated by FortiNDR Cloud WHOIS lookups. |
|
Hostnames |
Shows enrichment fields received from event records, including details such as OS name, OS major and minor versions, and any available login or logout timestamps. Where applicable, the data is presented in chronological order, providing clearer visibility into host-level enrichment information directly within the entity view. |
When CrowdStrike, EDR, and FortiManager integrations are enabled, the panel displays up to 50 of the most recent actions performed on the device, including manual isolation, automatic isolation, and removal of isolation.
Actions performed by the Fortinet Automation Service appear in the Fortinet Automation Service tab.
Adding annotations
To add an annotation:
- In the Summary tab click Add an Annotation. The Create an annotation dialog opens.
- From the Select an annotation type drop-down, select the annotation type.
- In the Enter an annotation name field, enter a name for the annotation.
- In the Enter a description field, enter the annotation.
- Click Save. The annotation is added to the Summary tab.
To modify annotations:
- In the Entity Panel, click Modify Annotations. The Manage Annotations for <IP_address> dialog opens.
- (Optional) In the search field, enter an annotation name.
- Select or deselect an annotation and click Update.
Viewing malicious files
To view malicious files with FortiGuard:
- In the investigation results, click the link in the File column.
- Click the link in the Files dialog.
- The FortiGuard area displays the File identified as malicious flag.
Date ranges
The date range displayed in the Entity Panel defaults to the time range of the page from which it was opened. Keep the following considerations in mind when view viewing results with the date range picker.
| Summary tab |
|
| Date out of range |
|
| Default time range |
|