Microsoft Defender XDR
Hunting and detectionGetHighVolumeAnomalyBehaviors() function in advanced hunting for Microsoft Defender XDR
In brief
The new reference describes a function that returns behaviors containing a HighVolumeAnomaly insight, which indicates unusually high activity compared with the behavioral baseline. It includes syntax, requirements, and a recent-behaviors query example.
What Defender admins need to know
No administrator action is required. Administrators can use the function to identify high-volume UEBA behaviors in Microsoft Defender XDR or Microsoft Sentinel in the Defender portal.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
new file mode 100644
title: GetHighVolumeAnomalyBehaviors() function in advanced hunting for Microsoft Defender XDR description: Learn how to use the GetHighVolumeAnomalyBehaviors() function to find UEBA behaviors that contain HighVolumeAnomaly insights. ms.service: defender-xdr ms.subservice: adv-hunting ms.author: pauloliveria author: poliveria ms.localizationpriority: medium ms.collection:
- m365-security
- tier3 ms.custom:
- cx-ti
- cx-ah
appliesto:
- Microsoft Defender XDR
- Microsoft Sentinel in the Microsoft Defender portal ms.topic: reference ms.date: 07/15/2026
GetHighVolumeAnomalyBehaviors()
Use the GetHighVolumeAnomalyBehaviors() function in advanced hunting to return behaviors that contain at least one HighVolumeAnomaly insight in the Insights column.
A HighVolumeAnomaly insight indicates that an unusually high volume of activity was detected compared to the established behavioral baseline.
Syntax
invoke GetHighVolumeAnomalyBehaviors()
Parameters
This function has no explicit parameters. Invoke it as part of a query on a tabular input that contains an Insights column of type string.
Return value
Returns the rows from the input table that contain at least one HighVolumeAnomaly insight. All columns from the input table are preserved.
Example
Find recent behaviors with unusually high activity volume
BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| where TimeGenerated > ago(7d)
| invoke GetHighVolumeAnomalyBehaviors()
| project TimeGenerated, BehaviorId, Title, Insights
| order by TimeGenerated desc
Related content
@@ -0,0 +1,60 @@+---+title: GetHighVolumeAnomalyBehaviors() function in advanced hunting for Microsoft Defender XDR+description: Learn how to use the GetHighVolumeAnomalyBehaviors() function to find UEBA behaviors that contain HighVolumeAnomaly insights.+ms.service: defender-xdr+ms.subservice: adv-hunting+ms.author: pauloliveria+author: poliveria+ms.localizationpriority: medium+ms.collection:+- m365-security+- tier3+ms.custom:+- cx-ti+- cx-ah+appliesto:+ - Microsoft Defender XDR+ - Microsoft Sentinel in the Microsoft Defender portal+ms.topic: reference+ms.date: 07/15/2026+---++# GetHighVolumeAnomalyBehaviors()++Use the `GetHighVolumeAnomalyBehaviors()` function in [advanced hunting](advanced-hunting-overview.md) to return behaviors that contain at least one `HighVolumeAnomaly` insight in the `Insights` column.++A `HighVolumeAnomaly` insight indicates that an unusually high volume of activity was detected compared to the established behavioral baseline.++## Syntax++```kusto+invoke GetHighVolumeAnomalyBehaviors()+```++## Parameters++This function has no explicit parameters. Invoke it as part of a query on a tabular input that contains an `Insights` column of type `string`.++## Return value++Returns the rows from the input table that contain at least one `HighVolumeAnomaly` insight. All columns from the input table are preserved.++## Example++### Find recent behaviors with unusually high activity volume++```kusto+BehaviorInfo+| where ServiceSource == "Microsoft Sentinel"+| where TimeGenerated > ago(7d)+| invoke GetHighVolumeAnomalyBehaviors()+| project TimeGenerated, BehaviorId, Title, Insights+| order by TimeGenerated desc+```++## Related content++- [Investigate anomalies on UEBA behaviors in Microsoft Sentinel](/azure/sentinel/ueba-anomalies-on-behaviors)+- [BehaviorInfo table](advanced-hunting-behaviorinfo-table.md)+- [Advanced hunting overview](advanced-hunting-overview.md)+- [Learn the query language](advanced-hunting-query-language.md)