https://live.paloaltonetworks.com/t5/integration-discussions/microsoft-sentinel-incident-custom-details-fetch-in-xsoar/m-p/1232259#M197 <P>Hi everyone,</P><P>I've configured the Microsoft Sentinel integration instance in XSOAR, and it's successfully fetching incidents along with associated entities. However, I'm unable to retrieve the <STRONG>custom details</STRONG> (also known as additionalData or customDetails in Sentinel) from those incidents.</P><P>These fields are critical for our triage and enrichment workflows, but they don't appear in the incident context or in the mapped fields after ingestion.</P><P>I’ve already:</P><UL><LI><P>Confirmed the Sentinel incidents contain custom details via the Azure portal.</P></LI><LI><P>Checked the raw output using !azure-sentinel-get-incident, and I can see properties.additionalData in the JSON.</P></LI><LI><P>Attempted to map those fields using the incident type mapper in XSOAR without success.</P></LI></UL><P>Has anyone encountered this issue or successfully extracted and mapped customDetails from Sentinel incidents into XSOAR incident fields?</P><P>Any advice on fixing this (via mapper, playbook, script, or otherwise) would be greatly appreciated!</P> Sat, 21 Jun 2025 11:11:29 GMT mlagha183 2025-06-21T11:11:29Z https://live.paloaltonetworks.com/t5/integration-discussions/microsoft-sentinel-incident-custom-details-fetch-in-xsoar/m-p/1232259#M197 <P>Hi everyone,</P><P>I've configured the Microsoft Sentinel integration instance in XSOAR, and it's successfully fetching incidents along with associated entities. However, I'm unable to retrieve the <STRONG>custom details</STRONG> (also known as additionalData or customDetails in Sentinel) from those incidents.</P><P>These fields are critical for our triage and enrichment workflows, but they don't appear in the incident context or in the mapped fields after ingestion.</P><P>I’ve already:</P><UL><LI><P>Confirmed the Sentinel incidents contain custom details via the Azure portal.</P></LI><LI><P>Checked the raw output using !azure-sentinel-get-incident, and I can see properties.additionalData in the JSON.</P></LI><LI><P>Attempted to map those fields using the incident type mapper in XSOAR without success.</P></LI></UL><P>Has anyone encountered this issue or successfully extracted and mapped customDetails from Sentinel incidents into XSOAR incident fields?</P><P>Any advice on fixing this (via mapper, playbook, script, or otherwise) would be greatly appreciated!</P> Sat, 21 Jun 2025 11:11:29 GMT https://live.paloaltonetworks.com/t5/integration-discussions/microsoft-sentinel-incident-custom-details-fetch-in-xsoar/m-p/1232259#M197 mlagha183 2025-06-21T11:11:29Z