Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Entity Behaviors Layer

4 September 2026New feature+11 / −9 lines

In brief

The article now describes anomaly insights on behavior records, including first-seen activity, unusual volumes, uncommon values, and threat-intelligence matches. It also clarifies entity-enrichment queries, supported Fortinet data, and the requirement for actively sending logs.

What Defender admins need to know

Verify that supported data sources are connected and actively sending logs to generate behaviors, and use the linked anomaly guidance during investigations.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

The UEBA behaviors layer enables faster threat detection, investigation, and response across your security operations, without requiring deep familiarity with every log source.

This articlesection explains how the UEBA behaviors layer works, how to enable the behaviors layer, and how to use behaviors to enhance security operations.

Watch the UEBA behaviors webinar for a full overview and demo of the UEBA behaviors layer.

| Alerts | Signal a potential security issue requiring attention | Trigger incident response workflows | | Behaviors | Neutral, structured summaries of activity - normal or abnormal- based on time windows or triggers, enriched with MITRE ATT&CK mappings and entity roles | Provide context and clarity for investigations, hunting, and detection |

Microsoft Sentinel can also add anomaly insights directly to behavior records, including first-seen activity, unusually high behavior volumes, uncommon values, and threat intelligence matches. For more information, see Investigate anomalies on UEBA behaviors.

Behavior types and records

When you enable the UEBA behaviors layer, Microsoft Sentinel processes supported security logs you collect into your Sentinel workspace in near real-time and summarizes two types of behavioral patterns: | Aggregated behaviors | Detect volume-based patterns by collecting related events over time windows |

  • User accessed 50+ resources in 1 hour
  • Login attempts from 10+ different IP addresses
| Convert high-volume logs into actionable security insights. This behavior type excels at identifying unusual activity levels. | | Sequenced behaviors | Identify multi-step patterns or complex attack chains that aren't obvious when you look at individual events | Access key created > used from new IP > privileged API calls | Detect sophisticated attack sequences and multi-stage threats. |

The UEBA behaviors layer summarizes behaviors at tailored time intervals specific to each behavior's logic, creating behavior records immediately when itthe UEBA behaviors layer identifies patterns or when the time windows close.

Each behavior record includes:

The behaviors abstraction layer

ThisThe following data-flow diagram illustratesshows how the UEBA behaviors layer transforms raw logs into structured behavior records that enhance security operations:

:::image type="content" source="media/entity-behaviors-layer/entity-behaviors-data-flow.svg" alt-text="Diagram that shows how the UEBA behaviors layer transforms raw logs into structured behavior records that enhance security operations." lightbox="media/entity-behaviors-layer/entity-behaviors-data-flow.svg" ::: 

| project TimeGenerated, Title, Description, TableName
```

  • Specific user — retrieve alljoin behavior records with entity data to list behaviors associated withfor a particular user over the last 7 days to build a complete activity timeline:days, showing each behavior's timestamp, title, description, and category:

    // Find all behaviors for a specific user over last 7 days
Data source Supported vendors, services, and logs Connector Supported behaviors
CommonSecurityLog1
  • Cyber Ark Vault
  • Palo Alto Threats
  • Fortinet
AWSCloudTrail
  • EC2
  • IAM
  • S3
  • EKS
  • Secrets Manager
GCPAuditLogs
  • Admin activity logs
  • Data access logs
  • Access transparency logs

To use the UEBA behaviors layer, you need:

  • A Microsoft Sentinel workspace that's onboarded to the Defender portal.
  • IngestConnect and actively send logs from at least one or more of the supported data source into the Analytics tier. The UEBA behaviors layer only generates behaviors when supported data sources are connected and actively sending logs. For more information about data tiers, see Manage data tiers and retention in Microsoft Sentinel.

Permissions required

Use the BehaviorId field to join BehaviorInfo with BehaviorEntities.

The following query correlates recentjoins BehaviorInfo with BehaviorEntities to enrich behavior records from the last day with their associated entities,related entity details, so you can see each behavior alongside the users, hosts, or IP addresses involved:involved during an investigation:

BehaviorInfo