Microsoft Security Operations Analyst Associate SC-200 Practice Question

Microsoft Sentinel detects entities in query results when the column name matches the pattern CustomEntity. By adding an extend statement that creates a new column named AccountCustomEntity and sets it equal to the existing UserPrincipalName field, Sentinel will classify every value in that column as a user account entity. Renaming the original column or projecting it under another name will not trigger automatic entity recognition unless the CustomEntity suffix is used, and there is no KQL function that converts a field into an entity implicitly.