Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud Apps
Hunting and detection

Investigate Defender for Cloud Apps and Defender for Cloud behaviors with advanced hunting

4 September 2026Doc update+15 / −18 lines

In brief

The article now covers investigating behaviors from both Defender for Cloud Apps and Defender for Cloud. It documents the BehaviorInfo and BehaviorEntities tables, BehaviorId joins, and adds context for sample investigation queries.

What Defender admins need to know

Administrators can use the updated schema and query guidance to investigate behavior data and related entities in advanced hunting.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Investigate behaviors with advanced hunting

While some anomaly detections focus primarily on detecting problematic security scenarios, others can help identifying and investigating anomalous user behavior that doesn't necessarily indicate a compromise. In such cases, Microsoft Defender for Cloud Apps and Microsoft Defender for Cloud use a separate data type,type called behaviors. to help identify and investigate anomalous user activity that doesn't necessarily indicate a compromise. Unlike anomaly detections that focus on problematic security scenarios, behaviors provide contextual insights into user actions that may warrant further review.

This article describes how to investigate Defender for Cloud Apps and Defender for Cloud behaviors with Microsoft Defender advanced hunting.

What is a behavior?

MITRE ATT&CK is a framework that classifies adversary tactics and methods. Behaviors are attached to MITRE ATT&CK categories and techniques, a framework that classifies adversary tactics and methods, and provide a deeper understanding about an event than is provided by the raw event data. Behavior data lies between raw event data and the alerts generated by an event.

While behaviors might be related to security scenarios, they're not necessarily a sign of malicious activity or a security incident. Each behavior is based on one or more raw events, and provides contextual insights into whatthe user or system activity that occurred at a specific time, using information that Defender for Cloud Apps ashas learned or identified.

To enhance the quality of alerts generated by Defender for Cloud Apps, and lower the number of false positives, Defender for Cloud Apps is currently transitioning security content from alerts to behaviors.

ThisThe transition of Defender for Cloud Apps security content from alerts to behaviors aims to remove policies from alerts that give low-quality detections, while still creating security scenarios that focus on out-of-the-box detections. In parallel, Defender for Cloud Apps sends behaviors to aid you in your investigations.

The transition process from alerts to behaviors includes the following phases:

  1. (Complete) Policies that generate behaviors are now disabled by default, and don't send alerts.

  2. Move to a cloud-managed detection model, removing customer-facing policies completely. ThisThe cloud-managed detection model phase is planned to provide both custom detections and selected alerts generated by internal policies for high-fidelity, security-focused scenarios.

The transition to behaviors also includes enhancements for supported behavior types and adjustments for policy-generated alerts for optimal accuracy.

Access behaviors in the Defender portal Advanced hunting page, and use behaviors by querying behavior tables and creating custom detection rules that include behavior data.

The behaviorsBehavior data is available in two tables: BehaviorInfo and BehaviorEntities. Their schema in the Advanced hunting page is similar to the AlertInfo table schema, and includes the. The following tables:table describes each behavior table:

Table name Description
BehaviorInfo Record per behavior with its metadata, including behavior title, MITRE Attack categories, and techniques.
BehaviorEntities Information on the entities that were part of the behavior. Can be multiple records per behavior.

To get complete information on a behavior and its entities, use BehaviorId as the primary key for the join. For example:The following query looks up a specific behavior by ID and joins it with related entities so you can inspect all associated artifacts:

BehaviorInfo

**Scenario**: You want to be alerted when a mass download is done by a specific user or a list of users that are prone to be compromised or to internal risk.

To do so, create a custom detection rule based on the following query:query. The query filters for `MassDownload` behavior entities tied to specific user accounts, helping you investigate potential data exfiltration activity:

```kusto
BehaviorEntities

**Scenario**: You want to query 100 recent behaviors related to the MITRE attack technique **Valid Accounts (T1078)**.

TheTo review the latest behaviors associated with the Valid Accounts (T1078) technique, run the following queryquery. It returns the 100 most recent behaviors mapped to the Valid Accounts (T1078) technique,matching behaviors, helping you identify potential credential-based threats:

```kusto
BehaviorInfo

**Scenario**: If you suspect that a user might have been compromised, investigate all related behaviors for that user.

TheUse the following query filters Defenderto find behaviors reported by Microsoft Cloud App Security for Cloud Apps behaviorsa specific user account. The query filters by service source and account UPNUPN, then joins related entities to retrieve allgive a complete view of the user's behavior records and associated entities for a specific user.records. Replace *username* with the name of the user you want to investigate:

```kusto
BehaviorInfo

**Scenario**: Investigate all behaviors where one of the entities is a suspicious IP address.

To trace activity associated with a suspicious IP address, use the following query to search behavior entities for matching remote IP values. The following query finds all behaviors associated with athe specified IP address, allowing you to traceidentify related user actions and entities linked to that IP.entities. Replace *suspicious IP* with the IP address you want to investigate.

```kusto
BehaviorEntities
- [Tutorial: Detect suspicious user activity with behavioral analytics](tutorial-suspicious-activity.md)

[!INCLUDE [Open support ticket](includes/support.md)]