From bb39b733fc31af70117948b05a415fae7da8372b Mon Sep 17 00:00:00 2001
From: Prem Kumar <85905240+PremMS-MDE@users.noreply.github.com>
Date: Tue, 21 Apr 2026 17:41:29 +0530
Subject: [PATCH 1/2] Document strong identifier requirements for XDR mapping

Added requirements for strong identifiers to ensure correct mapping of custom activity data in Microsoft Defender XDR.
---
 defender-xdr/entity-page-device.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/defender-xdr/entity-page-device.md b/defender-xdr/entity-page-device.md
index 542bfed9040..6d1101df4d6 100644
--- a/defender-xdr/entity-page-device.md
+++ b/defender-xdr/entity-page-device.md
@@ -146,6 +146,17 @@ You can elect not to show events from Microsoft Sentinel in the main timeline, a
 
 For more information about these activity events, see [Entity pages in Microsoft Sentinel](/azure/sentinel/entity-pages?tabs=defender-portal#entity-pages).
 
+### Strong Identifier Requirements for Unified Timeline (Sentinel → XDR Mapping)
+
+To ensure that custom activity data (e.g., Sophos alerts) is correctly mapped and visible in **Microsoft Defender XDR** (`security.microsoft.com`) under the **Device Timeline**, the ingested data must include multiple strong identifiers for the host/device.
+
+#### ✅ Required Strong Identifiers
+
+At minimum, one of the following valid combinations must be present:
+
+- **Hostname + NTDomain**
+- **Hostname + DNS Domain**
+
 > [!NOTE]
 >
 > For firewall events to be displayed, you'll need to enable the audit policy. For instructions, see [Audit Filtering Platform connection](/windows/security/threat-protection/auditing/audit-filtering-platform-connection).

From 8589f5841fc1f7fd21106cdd8b6b8ad607851bde Mon Sep 17 00:00:00 2001
From: Tim Sherer <28902327+TimShererWithAquent@users.noreply.github.com>
Date: Wed, 2 Sep 2026 12:31:04 -0700
Subject: [PATCH 2/2] Apply batched suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 defender-xdr/entity-page-device.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/defender-xdr/entity-page-device.md b/defender-xdr/entity-page-device.md
index fdde3eb4539..6beb2513bed 100644
--- a/defender-xdr/entity-page-device.md
+++ b/defender-xdr/entity-page-device.md
@@ -145,16 +145,16 @@ You can elect not to show events from Microsoft Sentinel in the main timeline, a
 
 For more information about these activity events, see [Entity pages in Microsoft Sentinel](/azure/sentinel/entity-pages?tabs=defender-portal#entity-pages).
 
-### Strong Identifier Requirements for Unified Timeline (Sentinel → XDR Mapping)
+#### Strong identifier requirements for unified timeline (Sentinel to XDR mapping)
 
-To ensure that custom activity data (e.g., Sophos alerts) is correctly mapped and visible in **Microsoft Defender XDR** (`security.microsoft.com`) under the **Device Timeline**, the ingested data must include multiple strong identifiers for the host/device.
+To ensure that custom activity data (for example, Sophos alerts) is correctly mapped and visible in **Microsoft Defender XDR** (`security.microsoft.com`) under the **Device Timeline**, the ingested data must include a strong identifier combination for the host.
 
-#### ✅ Required Strong Identifiers
+#### Required strong identifiers
 
-At minimum, one of the following valid combinations must be present:
+At a minimum, include one of the following strong identifier combinations:
 
-- **Hostname + NTDomain**
-- **Hostname + DNS Domain**
+- `HostName` + `NTDomain`
+- `HostName` + `DnsDomain`
 
 > [!NOTE]
 >