Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Investigate anomalies on UEBA behaviors in Microsoft Sentinel

4 September 2026Public preview+325 / −0 lines

In brief

New guidance explains how anomaly insights enrich UEBA behaviors, where findings are stored, the insight schema, prerequisites, and investigation use in the Microsoft Defender portal.

What Defender admins need to know

To use the capability, ensure the workspace is onboarded, the UEBA behaviors layer is enabled, a supported data source is connected, and a workspace is selected.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

new file mode 100644

title: Investigate anomalies on UEBA behaviors in Microsoft Sentinel description: Learn how Microsoft Sentinel enriches UEBA behaviors with anomaly insights and how to query these insights in the Microsoft Defender portal. ms.author: guywild author: guywi-ms ms.reviewer: mshechter ms.topic: how-to ms.date: 07/15/2026 ms.service: microsoft-sentinel appliesto: - Microsoft Sentinel in the Microsoft Defender portal ms.collection: usx-security ai-usage: ai-assisted ms.custom: msecd-doc-authoring-1014

#Customer intent: As a security analyst, I want to investigate anomalies associated with UEBA behaviors so that I can prioritize unusual activity and understand why a behavior might require further investigation.

Investigate anomalies on UEBA behaviors in Microsoft Sentinel (preview)

Microsoft Sentinel's User and Entity Behavior Analytics (UEBA) anomalies on behaviors capability enriches behavior records with contextual analysis and anomaly insights.

Instead of evaluating only individual events, Microsoft Sentinel evaluates the structured behaviors generated by the UEBA behaviors layer. This approach helps you investigate activity using the sequence, entities, and security context already associated with each behavior.

Anomaly insights can help you determine:

  • Whether a behavior or combination of entities was observed for the first time.
  • Whether an entity performed an unusually high volume of a behavior.
  • Whether an entity connected from a new or uncommon country or internet service provider (ISP).
  • Whether an IP address matched Microsoft threat intelligence.

These insights are added to the Insights column in the BehaviorInfo table and can help you triage alerts, hunt for threats, and create or tune detections.

Security value

UEBA anomalies on behaviors adds contextual anomaly information directly to each behavior, helping analysts understand why activity might require attention without pivoting between tables or tools.

  • Richer context without pivoting. First-seen activity, uncommon values, unusual countries or ISPs, and threat intelligence matches are included with the behavior.
  • Explainable insights. Each anomaly includes concrete fields that show why the activity was identified.
  • Behavior-aware anomaly detection. Insights retain the sequence, entities, and security context associated with the behavior.
  • Multi-cloud and third-party coverage. Insights apply across the Microsoft and non-Microsoft data sources supported by the UEBA behaviors layer.

Prerequisites

Before you begin, make sure that:

How anomalies on behaviors work

Microsoft Sentinel evaluates each behavior against learned baselines for the entities involved and across your organization.

The resulting anomaly and contextual findings are stored in the Insights column of the BehaviorInfo table. The column contains a JSON object with an Explainability array:

{
  "Explainability": [
    {
      "Type": "FirstSeen",
      "About": [
        {
          "Kind": "Account",
          "Value": "[email protected]"
        },
        {
          "Kind": "Country",
          "Value": "Sweden"
        }
      ]
    }
  ]
}

The Insights column is the primary location for anomaly findings and their explanations.

Related contextual enrichment data, such as IP location, ISP, and threat intelligence information, is stored separately under the ueba.enrichments key in the AdditionalFields column.

Insights column schema

Each object in the Explainability array can contain the following fields:

FieldRequiredDescription
TypeYesThe insight type. Identifies the kind of analytical finding.
ValueNoThe resolved value or result of the insight, such as a threat intelligence category.
AboutNoAn array containing the entities and context involved in the insight. Each entry contains a Kind and Value.

The About array can include entries such as:

KindExample value
ActionTypeBehaviorLateralSMBBurst
Account[email protected]
IP111.11.111.11
Hosthost01.contoso.com
CountrySweden
ISPZscaler Inc.
AmazonResourceAn AWS resource identifier

Insight types

The following insight types can appear in the Insights column:

Insight typeDescription
FirstSeenA behavior, entity, or combination of values was observed for the first time. For example, this might be the first time a user connected from a particular country or the first time a behavior was performed by an entity.
HighVolumeAnomalyAn unusually high volume of activity was detected compared to the established baseline.
UncommonValueA value is rarely observed across the tenant population. For example, very few users might connect from a particular country or ISP.
ThreatIntelA threat intelligence match was found for an indicator, such as an IP address associated with command and control, botnet, malicious URL, or honeypot activity.

Insight examples

The following examples show representative combinations of insight types and contextual entities.

Behavior first observed for an entity

{
  "Type": "FirstSeen",
  "About": [
    {
      "Kind": "ActionType",
      "Value": "BehaviorLateralSMBBurst"
    },
    {
      "Kind": "Account",
      "Value": "[email protected]"
    }
  ]
}

Unusually high behavior volume for an entity

{
  "Type": "HighVolumeAnomaly",
  "About": [
    {
      "Kind": "ActionType",
      "Value": "BehaviorLateralSMBBurst"
    },
    {
      "Kind": "Account",
      "Value": "[email protected]"
    }
  ]
}

Threat intelligence indicator associated with an IP address

{
  "Type": "ThreatIntel",
  "Value": "Botnet,C2",
  "About": [
    {
      "Kind": "IP",
      "Value": "111.11.111.11"
    }
  ]
}

Other possible insight combinations include:

ScenarioInsight typeContext
A behavior is observed for the first time in the tenantFirstSeenActionType
A user connects from a country for the first timeFirstSeenAccount, Country
A user connects through an ISP for the first timeFirstSeenAccount, ISP
A country is uncommon in the tenantUncommonValueCountry
An ISP is uncommon in the tenantUncommonValueISP
A country is observed for the first time in the tenantFirstSeenCountry
An ISP is observed for the first time in the tenantFirstSeenISP

Query anomaly insights directly

In advanced hunting, use the BehaviorInfo table to investigate anomaly insights.

The BehaviorInfo table can include behaviors from Microsoft Sentinel and other Microsoft Defender services. Use the ServiceSource column to limit the results to Microsoft Sentinel behaviors.

Find behaviors with a FirstSeen insight

BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| where Insights has "FirstSeen"

Find FirstSeen insights involving a specific account

BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| where Insights has "FirstSeen"
| where Insights has "[email protected]"
| extend ParsedInsights = parse_json(Insights)
| mv-apply insight = ParsedInsights.Explainability on (
    where tostring(insight.Type) == "FirstSeen"
    | where tostring(insight.About) has "[email protected]"
    | take 1
)

Find FirstSeen insights involving a country

BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| where Insights has "FirstSeen"
| where Insights has "Sweden"
| extend ParsedInsights = parse_json(Insights)
| mv-apply insight = ParsedInsights.Explainability on (
    where tostring(insight.Type) == "FirstSeen"
    | mv-apply about = insight.About on (
        where tostring(about.Kind) == "Country"
        | where tostring(about.Value) == "Sweden"
        | take 1
    )
    | take 1
)

Query insights with built-in functions

Advanced hunting provides built-in functions that abstract the underlying JSON structure in the Insights column. These functions make it easier to filter behaviors by insight type, entity or context type, entity value, or a combination of criteria.

All functions are invoked on an input table that contains an Insights column of type string. Select a function in the following table for its syntax, supported arguments, and usage examples.

FunctionPurpose
GetFirstSeenBehaviors()Find behaviors that contain a FirstSeen insight.
GetUncommonValueBehaviors()Find behaviors that contain an UncommonValue insight.
GetHighVolumeAnomalyBehaviors()Find behaviors that contain a HighVolumeAnomaly insight.
GetAnomalousBehaviorsByKind()Find behaviors with insights involving a specific entity or context type, such as an account, IP address, country, or ISP.
GetAnomalousBehaviorsByValue()Find behaviors with insights involving a specific entity or context value.
GetAnomalousBehaviorsAbout()Find behaviors whose insights match multiple entity or context criteria.

Example: Find FirstSeen behaviors

The following query uses GetFirstSeenBehaviors() to return Microsoft Sentinel behaviors that contain a FirstSeen insight:

BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| invoke GetFirstSeenBehaviors()
| project TimeGenerated, BehaviorId, Title, Insights

For more information about the invoke operator, see invoke operator.

Explore UEBA enrichments

The AdditionalFields column in BehaviorInfo can contain a ueba.enrichments object with contextual information used when Microsoft Sentinel evaluates behaviors.

These enrichment values provide the underlying contextual data used to calculate the insights in the Insights column and are also available for exploration as enrichments. They represent raw context rather than analytical findings.

The following enrichment fields are available:

KeyDescription
IPLocationThe city and country associated with the source IP address.
ISPThe organization that owns or registered the source IP address, such as an ISP or hosting provider.
ThreatIntelIndicatorTypeComma-separated threat intelligence categories matched to the IP address, such as C2, MaliciousUrl, or HoneypotAccess. A matching value can also generate a ThreatIntel insight in the Insights column.
ThreatIntelIndicatorDescriptionA human-readable explanation of the threat intelligence match, including detection methods and activity details.

The following example shows the ueba.enrichments structure:

{
  "ueba.enrichments": {
    "IPLocation": "pflugerville, united states",
    "ISP": "shodan llc",
    "ThreatIntelIndicatorType": "HoneypotAccess,C2,MaliciousUrl",
    "ThreatIntelIndicatorDescription": "IP address was categorized as honeypot activity."
  }
}

To retrieve UEBA enrichments for each behavior, use the following query:

BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| extend parsedAdditionalFields = parse_json(AdditionalFields)
| extend Enrichments = parsedAdditionalFields["ueba.enrichments"]
| project
    TimeGenerated,
    BehaviorId,
    Location = tostring(Enrichments.IPLocation),
    ISP = tostring(Enrichments.ISP),
    ThreatIntelType = tostring(Enrichments.ThreatIntelIndicatorType),
    ThreatIntelDescription = tostring(Enrichments.ThreatIntelIndicatorDescription)

What to expect after enabling behaviors

Anomaly insights are generated automatically after the UEBA behaviors layer is enabled and supported data is available.

Query the BehaviorInfo table or use the built-in advanced hunting functions to review the anomaly insights associated with your behaviors.

Pricing

UEBA anomalies on behaviors doesn't require a separate add-on or feature license.

Anomaly insight and enrichment data is added to the behavior records stored in your Microsoft Sentinel workspace. Standard Microsoft Sentinel and Log Analytics data charges apply.

For more information, see Pricing for the UEBA behaviors layer.

Related content