- Introduction to Context Management
- Onboarding a Context Table
- Custom Context Tables
- Create a Custom Context Table by Importing a CSV File
- Create a Custom Context Table Using the Add Custom Option
- Working with Filtered Context Tables
- View and Interact with a Custom or Filtered Context Table
- View the Details Panel for a Custom or Filtered Context Table
- Edit the Configuration of Custom or Filtered Context Tables
- Active Directory Context Tables
- Prerequisites to Onboard an Active Directory Context Table
- Create an Active Directory Context Table
- View and Interact with an Active Directory Context Table
- View the Details Panel for an Active Directory Context Table
- Edit the Configuration of an Active Directory Context Table
- Default Active Directory Attribute Mapping
- Microsoft Entra ID Context Tables
- Prerequisites to Onboard a Microsoft Entra ID Context Table
- Create a Microsoft Entra ID Context Table
- View and Interact with a Microsoft Entra ID Context Table
- View the Details Panel for a Microsoft Entra ID Context Table
- Edit the Configuration of a Microsoft Entra ID Context Table
- Default Microsoft Entra ID Attribute Mapping
- Okta Context Tables
- Custom Context Tables
- Add Data to an Existing Context Table
- Using Context Data in Downstream Applications
- Built-In Threat Intelligence Context Tables
- Context Management APIs
- Troubleshooting Context Management
Edit the Configuration of a Microsoft Entra ID Context Table
To edit the configuration of a Microsoft Entra ID context table:
On the Overview tab, click the Options icon (
) to the right of a specific Microsoft Entra ID context table and select Edit. The Configuration panel opens on the right. On the Definition tab, you can modify the following information:
Context Table Name – Enter a new name for the context table.
Note
Changing context table names is currently prohibited in order to avoid breaking functionality in downstream applications.
Microsoft Entra ID Collector – Select a different Microsoft Entra ID cloud collector as the source of data in the context table.
Click on the Review Attributes tab to modify the attribute mapping for the context table.
The attribute mapping table has the following columns (as shown in the image below):
– Shows whether a specific attribute is visible as a column in the context table. Use the icon next to each attribute to toggle the display on or off.Source Attribute – Shows a default set of attributes available from your Microsoft Entra ID. Some source attributes are listed simply as Calculated attribute. These are attributes that are calculated, either in format or in value. Hover over the Calculated attribute tag in the Source Attribute column to view a description of the attribute and its calculation.
Target Attribute – The Target Attributes column shows the Exabeam common information model attributes that are mapped to the Microsoft Entra ID attributes in your context table. For easy-to-read tables of the default attribute mapping, see:
– Indicates that an attribute is designated as the key attribute for the context table. The designated key and its mapping cannot be changed.
– Indicates that an attribute and its mapping cannot be changed.
You can modify the mapping of Microsoft Entra ID attributes, that are not key or locked attributes, in the following ways:
Hover over an attribute row where you want to change the mapping.
Click the delete icon (
) to remove the currently mapped target attribute.Then click Add Target Attributes and do one of the following:
Search for and select an existing target attribute to map it as the target.
Click Add Custom Attribute, enter a new attribute name, and click the plus icon (
) to add it to the list of available target attributes. It will be added with a custom icon (
) to the left of the attribute name. Then select the newly created target attribute to map it.
When you are satisfied with the configuration edits, click Update to save the changes.