Co-authors: Ron Shlomo and Ryan Smith
Security teams don't struggle with a lack of security signals. The real challenge is understanding which activity matters, why it stands out, and where to focus first.
Microsoft Sentinel's Behaviors layer already helps analysts transform raw security events into meaningful behavioral patterns. Today, we're making that experience both smarter and broader.
What if every behavior could immediately tell you not only what happened, but why it matters? We're bringing UEBA anomaly intelligence directly into the Behaviors layer, so every behavior now includes anomaly insights together with explainable context. At the same time, UEBA expands beyond identity signals to support network and cloud data sources, enabling richer behavioral insights across more of your environment and helping security teams detect suspicious activity wherever it occurs.
If you're new to these capabilities, we recommend reviewing our previous announcements on the UEBA expansion and the Behaviors public preview, which provide additional background on the Behaviors layer and its underlying UEBA capabilities.
What's new in Sentinel UEBA and Behaviors layer
Microsoft Sentinel’s Behaviors layer aggregates and sequences individual events into meaningful behavioral patterns, giving SOC teams the security context of who did what to whom and why it matters in one place, instead of sifting through raw telemetry in separated tables.
With this release, we're expanding the Behaviors layer. It now includes UEBA Anomalies and contextual enrichments directly within each behavior. In addition, the Behaviors layer now supports Fortinet logs via the CommonSecurityLog table. We're also expanding Classical UEBA beyond identity signals by adding support for network and cloud data sources: AWS GuardDuty, Check Point, Zscaler and Fortinet (via CommonSecurityLog). Together, these enhancements allow the SOC to receive a richer context and explainable anomaly detection for every behavior across a broader portion of the environment.
Adding context to every behavior—use case
The following example illustrates how UEBA Anomalies on Behaviors help analysts quickly identify suspicious activity by adding context to every behavior.
Scenario: Detecting a compromised FortiGate device
An attacker gains administrative access to a FortiGate firewall and begins making configuration changes to establish persistence and enable future access. Individually, each action may appear legitimate. Together, however, they form a potentially suspicious behavioral pattern. UEBA then layers anomaly insights and explainability on top of these Behaviors, providing the additional context needed to identify suspicious activity.
Examples of observed behaviors include:
- Firewall administrator signs in from a new geographic location.
- Configuration changes occur outside normal maintenance windows.
- A new administrator account is created.
- VPN settings or firewall rules are modified to enable new access paths.
- Unusual outbound traffic is detected through the FortiGate device.
Rather than presenting these as isolated events, UEBA enriches each behavior with anomaly insights and explainable context. Analysts can immediately understand why the activity stands out. For example, because the administrator has never performed this combination of actions before, the changes occurred at an unusual time, and multiple high-risk modifications happened within a short period. This helps security teams quickly identify high-risk activity, reduce investigation time, and respond before attackers can expand their access within the environment.
KQL examples
//Query 1: Logon and Configuration Change by user for the first time
BehaviorInfo
| where Timestamp > ago(30d)
| where ActionType == "BehaviorFortiGateReconfiguration"
| where Insights has "FirstSeen"
| extend AdditionalFields = todynamic(AdditionalFields)
| extend Hostname = AdditionalFields.ApplianceId
| extend User = AdditionalFields.ChangedBy[0]
| extend uebaEnrichments = AdditionalFields ["ueba.enrichments"]
| extend uebaInsights = todynamic(Insights).Explainability
| project ActionType, Description, Categories, AttackTechniques, ServiceSource, DataSources, User, Hostname, AdditionalFields, uebaInsights, uebaEnrichments
//Query 2: get HighVolumeAnomaly behaviors to detect high traffic for the suspicious host / IP
BehaviorInfo
| where Timestamp > ago(30d)
| where DataSources has "CommonSecurityLog"
| invoke GetAnomalousBehaviorsByValue(
"<Hostname>", //Extracted from Hostname in query 1
"HighVolumeAnomaly") Expanding visibility scross the environment—use cases
The following examples show how the new network data sources extend Behavioral analytics and UEBA Anomalies, helping uncover suspicious activity across more of your environment.
Scenario: Identifying suspicious web access with Zscaler telemetry
A user attempts to access a URL categorized as phishing, malware, spyware, or command-and-control. On its own, the event may appear as just another web-proxy log among thousands generated every day.
With Zscaler telemetry incorporated into behavioral analytics, UEBA identifies that the user has never accessed this high-risk URL category before and enriches the activity with user, destination, source IP, location, ISP, and threat intelligence context, helping analysts immediately understand why the event stands out. Rather than investigating an isolated web access event, analysts can quickly determine whether the activity indicates a phishing attempt or attacker-controlled infrastructure and respond before the compromise spreads.
KQL example
//Query 3: First-time high-risk web category access from an unusual location or ISP
Returns phishing, malware, spyware, or C2 category hits that are new for the user and come from an unusual location or network. Check RequestURL and UrlCategory for the destination.
BehaviorAnalytics
| where TimeGenerated > ago(7d)
| where EventSource == "CommonSecurityLog"
| where ActivityType == "UnusualHighRiskWebCategoryAccess"
| where ActivityInsights.DeviceVendor == "Zscaler"
| where ActivityInsights.DeviceProduct == "NSSWeblog"
| extend UrlCategory = ActivityInsights.UrlCategory
| extend RequestURL = ActivityInsights.RequestURL
| extend ISP = DevicesInsights.ISP
| extend ThreatIntel = DevicesInsights.ThreatIntelIndicatorType
| extend RiskyCategory = ActivityInsights.FirstTimeUserAccessedHighRiskUrlCategory == True
or ActivityInsights.FirstTimeHighRiskUrlCategoryObservedInTenant == True
| extend UnusualLocation = ActivityInsights.FirstTimeUserConnectedFromCountry == True
or ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True
or ActivityInsights.CountryUncommonlyConnectedFromByUser == True
| extend UnusualISP = ActivityInsights.FirstTimeUserConnectedViaISP == True
or ActivityInsights.ISPUncommonlyUsedByUser == True
or ActivityInsights.IPRegOrgUncommonlyUsedByUser == True
| where RiskyCategory and (UnusualLocation or UnusualISP or isnotempty(ThreatIntel))
The following example illustrates how Behaviors built on top of new network data source help analysts identify sensitive administrative activity that might otherwise appear routine.
Scenario: Identifying suspicious FortiGate configuration backups
A network administrator exports a FortiGate configuration backup. On its own, this action is common during maintenance, upgrades, or disaster recovery and is unlikely to trigger immediate investigation.
With Behaviors built on top of Fortinet telemetry, Microsoft Sentinel transforms this raw administrative event into a meaningful security context. Analysts can immediately see who performed the backup, which device was involved, how it was executed (GUI, API, RESTAPI, ssh or CLI), and whether the activity deviates from the user's normal behavior or occurred alongside other suspicious activity.
Instead of reviewing isolated firewall events, analysts can quickly determine whether the configuration export is part of legitimate administration or an early indicator of compromise, reconnaissance, or preparation for persistence.
KQL example
// Query 4: FortiGate configuration backup activity
BehaviorInfo
| where ActionType == "BehaviorFortiGateBackup"
| extend ParsedData = parse_json(AdditionalFields)
| extend
Device = tostring(ParsedData.ApplianceId),
User = tostring(ParsedData.Account),
SourceIP = tostring(ParsedData.LoginSourceIP)
| project TimeGenerated, Device, User, SourceIP, Description, AdditionalFields
| order by TimeGenerated Getting started
- In the Microsoft Defender portal, make sure the Behaviors layer is enabled and supported data sources are connected
- Baselines are built for approximately one week for high-quality anomalies.
- Explore the insights column in the BehaviorInfo table in Advanced Hunting.
- Enabling the new data sources for UEBA and Behaviors layer:
UEBA user interface.
We’d love to hear how your team is using these capabilities. Share your feedback to help us improve and expand coverage.
Why it matters
These updates represent another step in our commitment to making Behaviors and UEBA in Microsoft Sentinel more powerful, more explainable, and more broadly applicable across the environments your security team defends.
Microsoft
