---
title: "Using entities attributes in triggered Alerts"
canonical: "https://docs.devo.com/space/latest/1065844743/Using%20entities%20attributes%20in%20triggered%20Alerts"
format: markdown
---
> Macro (toc)

## Definition

In security, an **entity attribute** refers to  property of an entity that can be used to make access control or security decisions. A *User* is an entity, and a *user name* is an attribute. A *Device* is another kind of entity, and an *IP address* is a corresponding attribute.

Entity attributes are derived from the columns of the triggered alert data. The columns originate from the query defined in the [alert definition](https://docs.devo.com/space/latest/95126609/Alert+definitions+settings). These entity attributes are displayed on the [Triggered Alerts](https://docs.devo.com/space/latest/525860890/Navigate+triggered+alerts) page.

![Screenshot 2025-02-03 at 14.53.31.png](media://1c572b53-1f01-458a-9176-c361dcc28304)

## Adding Entities to alert queries 

- **Automatic:** The entity attributes are automatically detected by the entity model, limited to fields where Devo has high confidence that they are attributes. The Devo entity engine ensures seamless support for existing entity models on the platform while leveraging the latest advancements in entity detection.
- **Manual:** In most cases, entity attributes should be added manually to queries. After the attribute is named in the query, new alerts that are triggered will have attributes in the Triggered Alerts interface.

For manual Entity Attribute mapping, the following **column names** are allowed for attribute creation:

### Query Example

```
from demo.ecommerce.data
//reduce number of alerts
where clientIpAddress = 53.83.86.111
select 
"alice@example.fishing" as entity_sourceAccount,
"alice@example.fishing" as entity_sourceEmail,
"Alice" as entity_sourceName,
"example.fishing"  as entity_sourceDomain,
"bob@example.com" as entity_destinationAccount,
"bob@example.com" as entity_destinationEmail,
"Bob" as entity_destinationName,
"example.com" as entity_destinationDomain,
"vaultSolaris" as entity_sourceHostname,
"phishingWin95" as entity_destinationHostname,
"00-00-00-00-00-00" as entity_sourceMAC,
"FF-FF-FF-FF-FF-FF" as entity_destinationMAC,
ip4(1.1.1.1) as entity_sourceIP,
ip4(2.2.2.2) as entity_destinationIP,
ip4(3.3.3.3) as entity_machineIP,
"https://example.com/secrets" as entity_sourceUrl,
"http://example.onion/phish" as entity_destinationUrl,
"malware.exe" as entity_fileName,
"C:\\" as entity_filePath
```

### Entities attributes extracted from query

![Entities attributes query extraction.png](media://37322203-2596-46f9-a363-1e039bd857b9)