You provision Azure Sentinel for a new Azure subscription.

When creating analytics rules in Microsoft Sentinel (as shown in the rule query image), alerts can be grouped into incidents based on key entities. The extend command in the query defines custom entity map pings —in this case:

extend AccountCustomEntity = Account, HostCustomEntity = Computer

This configuration means Sentinel recognizes Account (User) and Computer (Host) as entities to correlate alerts. Incidents will group alerts sharing the same user account or computer , improving investigation efficiency.

According to Microsoft’s incident grouping guidance:

“You can group alerts into incidents by entities such as Account, Host, IP, URL, or custom-defined entities in the query.”

Hence, the correct answers are A. User and D. Computer .