Microsoft Sentinel Incident custom details fetch in XSOAR

[mlagha183]

Hi everyone,

I've configured the Microsoft Sentinel integration instance in XSOAR, and it's successfully fetching incidents along with associated entities. However, I'm unable to retrieve the custom details (also known as additionalData or customDetails in Sentinel) from those incidents.

These fields are critical for our triage and enrichment workflows, but they don't appear in the incident context or in the mapped fields after ingestion.

I’ve already:

• Confirmed the Sentinel incidents contain custom details via the Azure portal.

• Checked the raw output using !azure-sentinel-get-incident, and I can see properties.additionalData in the JSON.

• Attempted to map those fields using the incident type mapper in XSOAR without success.

Has anyone encountered this issue or successfully extracted and mapped customDetails from Sentinel incidents into XSOAR incident fields?

Any advice on fixing this (via mapper, playbook, script, or otherwise) would be greatly appreciated!