Microsoft Defender XDR
Hunting and detectionGetUncommonValueBehaviors() function in advanced hunting for Microsoft Defender XDR
In brief
The new reference page describes a no-parameter function that filters tabular input for rows containing an UncommonValue insight while preserving all columns. It includes a Microsoft Sentinel BehaviorInfo query example.
What Defender admins need to know
Administrators can use the function to identify UEBA behaviors with values rarely observed across the organization. No administrator action is stated.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
new file mode 100644
title: GetUncommonValueBehaviors() function in advanced hunting for Microsoft Defender XDR description: Learn how to use the GetUncommonValueBehaviors() function to find UEBA behaviors that contain UncommonValue insights. ms.service: defender-xdr ms.subservice: adv-hunting ms.author: pauloliveria author: poliveria ms.localizationpriority: medium ms.collection:
- m365-security
- tier3 ms.custom:
- cx-ti
- cx-ah
appliesto:
- Microsoft Defender XDR
- Microsoft Sentinel in the Microsoft Defender portal ms.topic: reference ms.date: 07/15/2026
GetUncommonValueBehaviors()
Use the GetUncommonValueBehaviors() function in advanced hunting to return behaviors that contain at least one UncommonValue insight in the Insights column.
An UncommonValue insight indicates that a value associated with the behavior, such as a country or internet service provider (ISP), is rarely observed across the organization.
Syntax
invoke GetUncommonValueBehaviors()
Parameters
This function has no explicit parameters. Invoke it as part of a query on a tabular input that contains an Insights column of type string.
Return value
Returns the rows from the input table that contain at least one UncommonValue insight. All columns from the input table are preserved.
Example
Find Microsoft Sentinel behaviors with uncommon values
BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| invoke GetUncommonValueBehaviors()
| project TimeGenerated, BehaviorId, Title, Insights
| order by TimeGenerated desc
Related content
@@ -0,0 +1,59 @@+---+title: GetUncommonValueBehaviors() function in advanced hunting for Microsoft Defender XDR+description: Learn how to use the GetUncommonValueBehaviors() function to find UEBA behaviors that contain UncommonValue insights.+ms.service: defender-xdr+ms.subservice: adv-hunting+ms.author: pauloliveria+author: poliveria+ms.localizationpriority: medium+ms.collection:+- m365-security+- tier3+ms.custom:+- cx-ti+- cx-ah+appliesto:+ - Microsoft Defender XDR+ - Microsoft Sentinel in the Microsoft Defender portal+ms.topic: reference+ms.date: 07/15/2026+---++# GetUncommonValueBehaviors()++Use the `GetUncommonValueBehaviors()` function in [advanced hunting](advanced-hunting-overview.md) to return behaviors that contain at least one `UncommonValue` insight in the `Insights` column.++An `UncommonValue` insight indicates that a value associated with the behavior, such as a country or internet service provider (ISP), is rarely observed across the organization.++## Syntax++```kusto+invoke GetUncommonValueBehaviors()+```++## Parameters++This function has no explicit parameters. Invoke it as part of a query on a tabular input that contains an `Insights` column of type `string`.++## Return value++Returns the rows from the input table that contain at least one `UncommonValue` insight. All columns from the input table are preserved.++## Example++### Find Microsoft Sentinel behaviors with uncommon values++```kusto+BehaviorInfo+| where ServiceSource == "Microsoft Sentinel"+| invoke GetUncommonValueBehaviors()+| project TimeGenerated, BehaviorId, Title, Insights+| order by TimeGenerated desc+```++## Related content++- [Investigate anomalies on UEBA behaviors in Microsoft Sentinel](/azure/sentinel/ueba-anomalies-on-behaviors)+- [BehaviorInfo table](advanced-hunting-behaviorinfo-table.md)+- [Advanced hunting overview](advanced-hunting-overview.md)+- [Learn the query language](advanced-hunting-query-language.md)