Microsoft Sentinel UEBA reference

This reference article lists the input data sources for the User and Entity Behavior Analytics service in Microsoft Sentinel. It also describes the enrichments that UEBA adds to entities, providing needed context to alerts and incidents.

UEBA data sources

These are the data sources from which the UEBA engine collects and analyzes data to train its ML models and set behavioral baselines for users, devices, and other entities. UEBA then looks at data from these sources to find anomalies and glean insights.

UEBA enrichments

This section describes the enrichments UEBA adds to Microsoft Sentinel entities, along with all their details, that you can use to focus and sharpen your security incident investigations. These enrichments are displayed on entity pages and can be found in the following Log Analytics tables, the contents and schema of which are listed below:

• The BehaviorAnalytics table is where UEBA's output information is stored.

  The following three dynamic fields from the BehaviorAnalytics table are described in the entity enrichments dynamic fields section below.

  • The UsersInsights and DevicesInsights fields contain entity information from Active Directory / Microsoft Entra ID and Microsoft Threat Intelligence sources.

  • The ActivityInsights field contains entity information based on the behavioral profiles built by Microsoft Sentinel's entity behavior analytics.

    User activities are analyzed against a baseline that is dynamically compiled each time it is used. Each activity has its defined lookback period from which the dynamic baseline is derived. The lookback period is specified in the Baseline column in this table.

• The IdentityInfo table is where identity information synchronized to UEBA from Microsoft Entra ID (and from on-premises Active Directory via Microsoft Defender for Identity) is stored.

BehaviorAnalytics table

The following table describes the behavior analytics data displayed on each entity details page in Microsoft Sentinel.

Entity enrichments dynamic fields

UsersInsights field

The following table describes the enrichments featured in the UsersInsights dynamic field in the BehaviorAnalytics table:

DevicesInsights field

The following table describes the enrichments featured in the DevicesInsights dynamic field in the BehaviorAnalytics table:

ActivityInsights field

The following tables describe the enrichments featured in the ActivityInsights dynamic field in the BehaviorAnalytics table:

Action performed

App used

Browser used

Country/region connected from

Device used to connect

Other device-related

Internet Service Provider used to connect

Resource accessed

Miscellaneous

IdentityInfo table

After you enable UEBA for your Microsoft Sentinel workspace, data from your Microsoft Entra ID is synchronized to the IdentityInfo table in Log Analytics for use in Microsoft Sentinel. You can embed user data synchronized from your Microsoft Entra ID in your analytics rules to enhance your analytics to fit your use cases and reduce false positives.

While the initial synchronization may take a few days, once the data is fully synchronized:

• Changes made to your user profiles, groups, and roles in Microsoft Entra ID are updated in the IdentityInfo table within 15-30 minutes.

• Every 14 days, Microsoft Sentinel re-synchronizes with your entire Microsoft Entra ID to ensure that stale records are fully updated.

• Default retention time in the IdentityInfo table is 30 days.

Limitations

• Currently, only built-in roles are supported.

• Data about deleted groups, where a user was removed from a group, is not currently supported.

Versions of the IdentityInfo table

There are actually two versions of the IdentityInfo table:

• The Log Analytics schema version serves Microsoft Sentinel in the Azure portal.
• The Advanced hunting schema version serves Microsoft Sentinel in the Microsoft Defender portal via Microsoft Defender for Identity.

Both versions of this table are fed by Microsoft Entra ID, but the Log Analytics version added a few fields.

Microsoft Sentinel in the Microsoft Defender portal, uses the Advanced hunting version of this table. To minimize the differences between the two versions of the table, most of the unique fields in the Log Analytics version are gradually being added to the Advanced hunting version as well. Regardless of in which portal you're using Microsoft Sentinel, you'll have access to nearly all the same information, though there may be a small time lag in synchronization between the versions. For more information, see the documentation of the Advanced hunting version of this table.

The following table describes the user identity data included in the IdentityInfo table in Log Analytics in the Azure portal. The fourth column shows the corresponding fields in the Advanced hunting version of the table, that Microsoft Sentinel uses in the Defender portal. Field names in boldface are named differently in the Advanced hunting schema than they are in the Microsoft Sentinel Log Analytics version.

Next steps

This document described the Microsoft Sentinel entity behavior analytics table schema.

• Learn more about entity behavior analytics.
• Enable UEBA in Microsoft Sentinel.
• Put UEBA to use in your investigations.