This document explains how to use the Entity Explorer page in Google Security Operations.
Entities are the core components of security events. On the Cases page, you can click an entity to open the Entity Explorer page, where you can review detailed insights and contextual data related to that entity.
The Entity Explorer page gives you insights into:
The entity's involvement in cases over the past 90 days. This data might differ
from what's shown in the side panel. For example, a URL flagged
as suspicious = true and highlighted in red
in the side panel, might appear as false, depending on how it's
categorized in other cases.
Basic information about the entity, along with enriched information from associated
cases.
Linked entities, such as related users or IP addresses.
The frequency of each case type that involves the entity.
A list of relevant log entries.
Click keyboard_arrow_downDown Arrow or keyboard_arrow_upUp Arrow next to each category name to expand or collapse the section.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-18 UTC."],[[["The Entity Explorer page provides a comprehensive view of an entity's involvement in security cases within the last three months."],["This page displays details about an entity, including basic and enriched information gathered from various cases."],["You can see linked entities, such as users and IP addresses, associated with the selected entity."],["The Entity Explorer shows the frequency of each type of case the entity has been involved in, along with a list of associated log entries."]]],[]]
