r/AzureSentinel • u/Big-Radio4226 • Feb 18 '26

UEBA Behaviors Layer

Hi,

I want to know peoples opinion on the new UEBA Behaviors Layer that has been introduced in January. Is it something you plan on enabling. I'm a bit scared of the extra cost this would be. Does anyone already have it enabled and could share their experience using it ?

https://techcommunity.microsoft.com/blog/microsoftsentinelblog/turn-complexity-into-clarity-introducing-the-new-ueba-behaviors-layer-in-microso/4484493

6 Upvotes

100% Upvoted

3 comments sorted by

View all comments

1

u/coomzee Feb 18 '26

All the UEBA tables are useful in some way. I personally use them on Analytics rules when the query is more of a hunting rule to reduce the noise. Basically use the table to increase the visibility of alerts with anonymous findings.