You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/use-entity-behavior-analytics-azure-sentinel/2-understand-user-entity-behavior-analytics.yml
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/use-entity-behavior-analytics-azure-sentinel/4a-use-anomaly-detection-analytical-rule-templates.yml
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/use-entity-behavior-analytics-azure-sentinel/includes/2-understand-user-entity-behavior-analytics.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,12 @@
1
-
Identifying threats inside your organization and their potential impact - whether a compromised entity or a malicious insider - has always been a time-consuming and labor-intensive process. When you're sifting through alerts, connecting the dots, and actively hunting, it adds up to massive amounts of time and effort expended with minimal returns. And, the possibility of sophisticated threats evading discovery. Elusive threats like zero-day, targeted, and advanced persistent threats can be the most dangerous to your organization, making their detection all the more critical.
1
+
Identifying threats inside your organization and their potential impact - whether a compromised entity or a malicious insider - is a time-consuming and labor-intensive process. When you're sifting through alerts, connecting the dots, and actively hunting, it adds up to massive amounts of time and effort expended with minimal returns. And, the possibility of sophisticated threats evading discovery. Elusive threats like zero-day, targeted, and advanced persistent threats can be the most dangerous to your organization, making their detection all the more critical.
2
2
3
3
The Entity Behavior capability in Microsoft Sentinel eliminates the drudgery from your analysts’ workloads, and the uncertainty from their efforts. The Entity Behavior capability delivers high-fidelity and actionable intelligence, so they can focus on investigation and remediation.
4
4
5
-
As Microsoft Sentinel collects logs and alerts from all the connected data sources, it analyzes and builds baseline behavioral profiles of your organization’s entities (users, hosts, IP addresses, applications etc.). The analysis is across the time and peer group horizon. Microsoft Sentinel uses various techniques and machine learning capabilities, and can then identify anomalous activity and help you determine if an asset has been compromised. Not only that, but it can also figure out the relative sensitivity of particular assets, identify peer groups of assets, and evaluate the potential impact of any given compromised asset (its “blast radius”). Armed with this information, you can effectively prioritize your investigation and incident handling.
5
+
As Microsoft Sentinel collects logs and alerts from all the connected data sources, it analyzes and builds baseline behavioral profiles of your organization’s entities (users, hosts, IP addresses, applications, etc.). The analysis is across the time and peer group horizon. Microsoft Sentinel uses various techniques and machine learning capabilities, and can then identify anomalous activity and help you determine if an asset is compromised. Not only that, but it can also figure out the relative sensitivity of particular assets, identify peer groups of assets, and evaluate the potential impact of any given compromised asset (its "blast radius"). Armed with this information, you can effectively prioritize your investigation and incident handling.
6
6
7
7
### Architecture overview
8
8
9
-
:::image type="content" source="../media/entity-behavior-1.png" alt-text="Diagram of the E U B A architecture overview.":::
9
+
:::image type="content" source="../media/entity-behavior-1.png" alt-text="Diagram of the UEBA architecture overview.":::
10
10
11
11
### Security-driven analytics
12
12
@@ -18,7 +18,7 @@ Microsoft adopted Gartner’s paradigm for UEBA solutions, Microsoft Sentinel pr
18
18
19
19
**Analytics:** Microsoft Sentinel uses machine learning (ML) algorithms, and identifies anomalous activities that presents evidence clearly and concisely in the form of contextual enrichments. See the examples below.
20
20
21
-
:::image type="content" source="../media/entity-behavior-2.png" alt-text="Image of Security Driven Analytics enrichment.":::
21
+
:::image type="content" source="../media/entity-behavior-2.png" alt-text="Diagram showing security-driven analytics enrichment examples in Microsoft Sentinel.":::
22
22
23
23
Microsoft Sentinel presents artifacts that help your security analysts get a clear understanding of anomalous activities in context, and in comparison with the user's baseline profile. Actions performed by a user (or a host, or an address) are evaluated contextually, where a "true" outcome indicates an identified anomaly:
24
24
@@ -30,9 +30,9 @@ Microsoft Sentinel presents artifacts that help your security analysts get a cle
30
30
31
31
- As compared to organization's behavior.
32
32
33
-
:::image type="content" source="../media/entity-behavior-3.png" alt-text="image showing the E U B A Context rings.":::
33
+
:::image type="content" source="../media/entity-behavior-3.png" alt-text="Diagram showing the UEBA context rings used to evaluate user activity.":::
34
34
35
35
### Scoring
36
36
37
-
Each activity is scored with “Investigation Priority Score”. The score determines the probability of a specific user performing a specific activity based on behavioral learning of the user and their peers. Activities identified as the most abnormal receive the highest scores (on a scale of 0-10).
37
+
Each activity is scored with "Investigation Priority Score". The score determines the probability of a specific user performing a specific activity based on behavioral learning of the user and their peers. Activities identified as the most abnormal receive the highest scores (on a scale of 0-10).
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/use-entity-behavior-analytics-azure-sentinel/includes/3-explore-entities.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,10 +1,10 @@
1
-
When alerts are sent to Microsoft Sentinel, they include data elements that Microsoft Sentinel identifies and classifies as entities, such as user accounts, hosts, IP addresses and others. On occasion, this identification can be a challenge, if the alert doesn't contain sufficient information about the entity.
1
+
When alerts are sent to Microsoft Sentinel, they include data elements that Microsoft Sentinel identifies and classifies as entities, such as user accounts, hosts, IP addresses, and others. On occasion, this identification can be a challenge, if the alert doesn't contain sufficient information about the entity.
2
2
3
3
For example, user accounts can be identified in more than one way: using a Microsoft Entra account’s numeric identifier (GUID), or its User Principal Name (UPN) value, or alternatively, using a combination of its username and its NT domain name. Different data sources can identify the same user in different ways. Therefore, whenever possible, Microsoft Sentinel merges those identifiers into a single entity, so that it can be properly identified.
4
4
5
5
It can happen, though, that one of your resource providers creates an alert in which an entity isn't sufficiently identified - for example, a user name without the domain name context. In such a case, the user entity can't be merged with other instances of the same user account, which would be identified as a separate entity, and those two entities would remain separate instead of unified.
6
6
7
-
In order to minimize the risk of this happening, you should verify that all of your alert providers properly identify the entities in the alerts they produce. Additionally, synchronizing user account entities with Microsoft Entra ID may create a unifying directory, which will be able to merge user account entities.
7
+
In order to minimize the risk of this happening, you should verify that all of your alert providers properly identify the entities in the alerts they produce. Additionally, synchronizing user account entities with Microsoft Entra ID may create a unifying directory, which is able to merge user account entities.
8
8
9
9
The following types of entities are currently identified in Microsoft Sentinel:
10
10
@@ -48,7 +48,7 @@ The following types of entities are currently identified in Microsoft Sentinel:
48
48
49
49
### Entity pages
50
50
51
-
When you encounter any entity (currently limited to users and hosts) in a search, an alert, or an investigation, you can select the entity and be taken to an **entity page**, a datasheet full of useful information about that entity. The types of information you'll find on this page include basic facts about the entity, a timeline of notable events related to this entity and insights about the entity's behavior.
51
+
When you encounter any entity (currently limited to users and hosts) in a search, an alert, or an investigation, you can select the entity and be taken to an **entity page**, a datasheet full of useful information about that entity. The types of information you find on this page include basic facts about the entity, a timeline of notable events related to this entity and insights about the entity's behavior.
52
52
53
53
Entity pages consist of three parts:
54
54
@@ -60,7 +60,7 @@ Entity pages consist of three parts:
60
60
61
61
### The timeline
62
62
63
-
:::image type="content" source="../media/entity-behavior-4.png" alt-text="Screen shot of an Entity Behavior timeline.":::
63
+
:::image type="content" source="../media/entity-behavior-4.png" alt-text="Screenshot of an entity behavior timeline in Microsoft Sentinel.":::
64
64
65
65
The timeline is a major part of the entity page's contribution to behavior analytics in Microsoft Sentinel. It presents a story about entity-related events, helping you understand the entity's activity within a specific time frame.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/use-entity-behavior-analytics-azure-sentinel/includes/6-summary-resources.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,4 +1,4 @@
1
-
You should have learned how to use entity behavior analytics in Microsoft Sentinel to identify threats inside your organization.
1
+
You learned how to use entity behavior analytics in Microsoft Sentinel to identify threats inside your organization.
2
2
3
3
You should now be able to:
4
4
@@ -10,6 +10,6 @@ You should now be able to:
10
10
11
11
You can learn more by reviewing the following.
12
12
13
-
[Become a Microsoft Sentinel Ninja](https://techcommunity.microsoft.com/t5/azure-sentinel/become-an-azure-sentinel-ninja-the-complete-level-400-training/ba-p/1246310?azure-portal=true)
13
+
[Become a Microsoft Sentinel Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-ninja-the-complete-level-400/ba-p/1246310?azure-portal=true)
14
14
15
15
[Microsoft Tech Community Security Webinars](https://techcommunity.microsoft.com/t5/microsoft-security-and/security-community-webinars/ba-p/927888?azure-portal=true)
0 commit comments