Forum Discussion

RohitN026's avatar
RohitN026
Copper Contributor
Feb 24, 2026

Clarification on UEBA Behaviors Layer Support for Zscaler and Fortinet Logs

I would like to confirm whether the new UEBA Behaviors Layer in Microsoft Sentinel currently supports generating behavior insights for Zscaler and Fortinet log sources. 

Based on the documentation, the preview version of the Behaviors Layer only supports specific vendors under CommonSecurityLog (CyberArk Vault and Palo Alto Threats), AWS CloudTrail services, and GCP Audit Logs. Since Zscaler and Fortinet are not listed among the supported vendors, I want to verify:

Does the UEBA Behaviors Layer generate behavior records for Zscaler and Fortinet logs, or are these vendors currently unsupported for behavior generation? As logs from Zscaler and Fortinet will also be get ingested in CommonSecurityLog table only.

alerts
KQL
siem
ueba

1 Reply

  • Caleb_A_McDowell's avatar
    Caleb_A_McDowell
    Copper Contributor
    Feb 26, 2026

    You're reading the docs correctly. Zscaler and Fortinet are not currently supported by the UEBA Behaviors Layer, even though their logs land in the CommonSecurityLog table.

    This is a common point of confusion. Just because a vendor writes to CommonSecurityLog doesn't mean the Behaviors Layer will pick it up. Microsoft is explicit about this in the documentation. The Behaviors Layer only generates behavior records for supported vendors and log types within that table. Right now, that's limited to:

    • CyberArk Vault
    • Palo Alto Threats

    So your Zscaler and Fortinet logs will sit in CommonSecurityLog just fine, but the Behaviors Layer won't produce any behavior insights from them. You won't see behavior records, and that's expected. It's not a configuration issue on your end.

    Now here's where it gets interesting. Microsoft has said the list of supported data sources and vendors is "evolving." They're actively expanding coverage. If you look at the UEBA anomaly side of things (separate from the Behaviors Layer), they recently added support for Okta, GCP, and additional AWS sources. So the trajectory is clearly toward broader vendor support.

    What you can do right now:

    • Keep ingesting Zscaler and Fortinet into CommonSecurityLog as normal
    • Use standard UEBA anomaly detection (which works on sign-in data regardless of the Behaviors Layer)
    • Write custom analytics rules against those logs to fill the gap
    • Watch for updates as Microsoft expands the supported vendor list during the preview

    The full breakdown of what's supported is here: https://learn.microsoft.com/azure/sentinel/entity-behaviors-layer#supported-data-sources-and-behaviors

    Please mark as solution, if you find the answer helpful. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided.