Investigate anomalies on UEBA behaviors in Microsoft Sentinel (preview)

Microsoft Sentinel's User and Entity Behavior Analytics (UEBA) anomalies on behaviors capability enriches behavior records with contextual analysis and anomaly insights.

Instead of evaluating only individual events, Microsoft Sentinel evaluates the structured behaviors generated by the UEBA behaviors layer. This approach helps you investigate activity using the sequence, entities, and security context already associated with each behavior.

Anomaly insights can help you determine:

• Whether a behavior or combination of entities was observed for the first time.
• Whether an entity performed an unusually high volume of a behavior.
• Whether an entity connected from a new or uncommon country or internet service provider (ISP).
• Whether an IP address matched Microsoft threat intelligence.

These insights are added to the Insights column in the BehaviorInfo table and can help you triage alerts, hunt for threats, and create or tune detections.

Security value

UEBA anomalies on behaviors adds contextual anomaly information directly to each behavior, helping analysts understand why activity might require attention without pivoting between tables or tools.

• Richer context without pivoting. First-seen activity, uncommon values, unusual countries or ISPs, and threat intelligence matches are included with the behavior.
• Explainable insights. Each anomaly includes concrete fields that show why the activity was identified.
• Behavior-aware anomaly detection. Insights retain the sequence, entities, and security context associated with the behavior.
• Multi-cloud and third-party coverage. Insights apply across the Microsoft and non-Microsoft data sources supported by the UEBA behaviors layer.

Prerequisites

Before you begin, make sure that:

• Your Microsoft Sentinel workspace is onboarded to the unified security operations platform.
• The UEBA behaviors layer is enabled, and at least one supported data source is connected and sending data to the Analytics tier.
• A workspace is selected for the UEBA behaviors layer.

How anomalies on behaviors work

Microsoft Sentinel evaluates each behavior against learned baselines for the entities involved and across your organization.

The resulting anomaly and contextual findings are stored in the Insights column of the BehaviorInfo table. The column contains a JSON object with an Explainability array:

{
  "Explainability": [
    {
      "Type": "FirstSeen",
      "About": [
        {
          "Kind": "Account",
          "Value": "jsmith@contoso.com"
        },
        {
          "Kind": "Country",
          "Value": "Sweden"
        }
      ]
    }
  ]
}

The Insights column is the primary location for anomaly findings and their explanations.

Related contextual enrichment data, such as IP location, ISP, and threat intelligence information, is stored separately under the ueba.enrichments key in the AdditionalFields column.

Insights column schema

Each object in the Explainability array can contain the following fields:

The About array can include entries such as:

Insight types

The following insight types can appear in the Insights column:

Insight examples

The following examples show representative combinations of insight types and contextual entities.

Behavior first observed for an entity

{
  "Type": "FirstSeen",
  "About": [
    {
      "Kind": "ActionType",
      "Value": "BehaviorLateralSMBBurst"
    },
    {
      "Kind": "Account",
      "Value": "jsmith@contoso.com"
    }
  ]
}

Unusually high behavior volume for an entity

{
  "Type": "HighVolumeAnomaly",
  "About": [
    {
      "Kind": "ActionType",
      "Value": "BehaviorLateralSMBBurst"
    },
    {
      "Kind": "Account",
      "Value": "jsmith@contoso.com"
    }
  ]
}

Threat intelligence indicator associated with an IP address

{
  "Type": "ThreatIntel",
  "Value": "Botnet,C2",
  "About": [
    {
      "Kind": "IP",
      "Value": "111.11.111.11"
    }
  ]
}

Other possible insight combinations include:

Query anomaly insights directly

In advanced hunting, use the BehaviorInfo table to investigate anomaly insights.

The BehaviorInfo table can include behaviors from Microsoft Sentinel and other Microsoft Defender services. Use the ServiceSource column to limit the results to Microsoft Sentinel behaviors.

Find behaviors with a FirstSeen insight

BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| where Insights has "FirstSeen"

Find FirstSeen insights involving a specific account

BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| where Insights has "FirstSeen"
| where Insights has "jsmith@contoso.com"
| extend ParsedInsights = parse_json(Insights)
| mv-apply insight = ParsedInsights.Explainability on (
    where tostring(insight.Type) == "FirstSeen"
    | where tostring(insight.About) has "jsmith@contoso.com"
    | take 1
)

Find FirstSeen insights involving a country

BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| where Insights has "FirstSeen"
| where Insights has "Sweden"
| extend ParsedInsights = parse_json(Insights)
| mv-apply insight = ParsedInsights.Explainability on (
    where tostring(insight.Type) == "FirstSeen"
    | mv-apply about = insight.About on (
        where tostring(about.Kind) == "Country"
        | where tostring(about.Value) == "Sweden"
        | take 1
    )
    | take 1
)

Query insights with built-in functions

Advanced hunting provides built-in functions that abstract the underlying JSON structure in the Insights column. These functions make it easier to filter behaviors by insight type, entity or context type, entity value, or a combination of criteria.

All functions are invoked on an input table that contains an Insights column of type string. Select a function in the following table for its syntax, supported arguments, and usage examples.

Example: Find FirstSeen behaviors

The following query uses GetFirstSeenBehaviors() to return Microsoft Sentinel behaviors that contain a FirstSeen insight:

BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| invoke GetFirstSeenBehaviors()
| project TimeGenerated, BehaviorId, Title, Insights

For more information about the invoke operator, see invoke operator.

Explore UEBA enrichments

The AdditionalFields column in BehaviorInfo can contain a ueba.enrichments object with contextual information used when Microsoft Sentinel evaluates behaviors.

These enrichment values provide the underlying contextual data used to calculate the insights in the Insights column and are also available for exploration as enrichments. They represent raw context rather than analytical findings.

The following enrichment fields are available:

The following example shows the ueba.enrichments structure:

{
  "ueba.enrichments": {
    "IPLocation": "pflugerville, united states",
    "ISP": "shodan llc",
    "ThreatIntelIndicatorType": "HoneypotAccess,C2,MaliciousUrl",
    "ThreatIntelIndicatorDescription": "IP address was categorized as honeypot activity."
  }
}

To retrieve UEBA enrichments for each behavior, use the following query:

BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| extend parsedAdditionalFields = parse_json(AdditionalFields)
| extend Enrichments = parsedAdditionalFields["ueba.enrichments"]
| project
    TimeGenerated,
    BehaviorId,
    Location = tostring(Enrichments.IPLocation),
    ISP = tostring(Enrichments.ISP),
    ThreatIntelType = tostring(Enrichments.ThreatIntelIndicatorType),
    ThreatIntelDescription = tostring(Enrichments.ThreatIntelIndicatorDescription)

What to expect after enabling behaviors

Anomaly insights are generated automatically after the UEBA behaviors layer is enabled and supported data is available.

Query the BehaviorInfo table or use the built-in advanced hunting functions to review the anomaly insights associated with your behaviors.

Pricing

UEBA anomalies on behaviors doesn't require a separate add-on or feature license.

Anomaly insight and enrichment data is added to the behavior records stored in your Microsoft Sentinel workspace. Standard Microsoft Sentinel and Log Analytics data charges apply.

For more information, see Pricing for the UEBA behaviors layer.

Related content

• Advanced threat detection with User and Entity Behavior Analytics
• Translate raw security logs to behavioral insights using UEBA behaviors
• Enable entity behavior analytics
• UEBA data sources and table schemas
• Anomalies detected by the Microsoft Sentinel machine learning engine
• Proactively hunt for threats with advanced hunting in Microsoft Defender