Skip to content

Commit 2dcf4db

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #297086 from yelevin/yelevin/ueba-fixes
Added group warnings to UEBA
2 parents 0b7af76 + ba96bae commit 2dcf4db

File tree

2 files changed

+73
-56
lines changed

2 files changed

+73
-56
lines changed

‎articles/sentinel/sentinel-service-limits.md

Lines changed: 49 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
title: Microsoft Sentinel service limits
3-
description: This article provides a list of service limits for Microsoft Sentinel.
3+
description: This article provides a list of service limits for Microsoft Sentinel, divided into the different service areas.
44
author: yelevin
5-
ms.topic: conceptual
5+
ms.topic: reference
66
ms.date: 03/19/2025
77
ms.author: yelevin
88
ms.service: microsoft-sentinel
@@ -20,8 +20,8 @@ This article lists the most common service limits you might encounter as you use
2020

2121
The following limit applies to analytics rules in Microsoft Sentinel.
2222

23-
| Description | Limit | Dependency |
24-
| --------- | --------- | --------- |
23+
| Description | Limit | Dependency |
24+
| ----------- | ----- | ---------- |
2525
| Number of [scheduled rules](scheduled-rules-overview.md) | 512 *enabled* rules | Counted separately from NRT rules |
2626
| Number of [near-real-time (NRT) rules](near-real-time-rules.md) | 50 *enabled* rules | Counted separately from scheduled rules |
2727
| [Entity mappings](map-data-fields-to-entities.md) | 10 mappings per rule | None |
@@ -37,15 +37,15 @@ The following limit applies to analytics rules in Microsoft Sentinel.
3737
The following limits apply to Hunts in Microsoft Sentinel.
3838

3939
| Description | Limit | Dependency |
40-
| --------- | --------- | ------- |
40+
| ----------- | ----- | ---------- |
4141
|Number of Hunts | 100 | None |
4242

4343
## Incident limits
4444

4545
The following limits apply to incidents in Microsoft Sentinel.
4646

4747
| Description | Limit | Dependency |
48-
| --------- | --------- | ------- |
48+
| ----------- | ----- | ---------- |
4949
| Investigation experience availability | 90 days from the incident last update time | None |
5050
| Retention period for incident entities | 180 days | Entities database retention |
5151
| Number of alerts | 150 alerts | None |
@@ -69,18 +69,17 @@ However, a SOC that experiences the creation of more than *around* 3,000 new inc
6969

7070
The following limits apply to machine learning-based features in Microsoft Sentinel like customizable anomalies and Fusion.
7171

72-
| Description | Limit |Dependency|
73-
|---------------------------------------------------------------|-------------------------------------------------|-------|
74-
| Number of anomalies published per anomaly type | Top 3000 ranked by anomaly score |None|
75-
| Number of alerts and/or anomalies in a single Fusion incident | 100 alerts and/or anomalies |None|
76-
72+
| Description | Limit | Dependency |
73+
| ------------------------------------------------------------- | -------------------------------- | ---------- |
74+
| Number of anomalies published per anomaly type | Top 3000 ranked by anomaly score | None |
75+
| Number of alerts and/or anomalies in a single Fusion incident | 100 alerts and/or anomalies | None |
7776

7877
## Multi workspace limits
7978

8079
The following limit applies to multiple workspaces in Microsoft Sentinel. Limits here are applied when working with Sentinel features across more than workspace at a time.
8180

82-
|Description | Limit |Dependency|
83-
-------------------------|--------------------|--------------------|
81+
| Description | Limit | Dependency |
82+
| ----------- | ----- | ---------- |
8483
| Incident view | 100 concurrently displayed workspaces | |
8584
| Log query | 100 Sentinel workspaces | [Log Analytics](/azure/azure-monitor/logs/cross-workspace-query#limitations) |
8685
| Analytics rules | 20 Sentinel workspaces per query | |
@@ -89,66 +88,67 @@ The following limit applies to multiple workspaces in Microsoft Sentinel. Limits
8988

9089
The following limits apply to notebooks in Microsoft Sentinel. The limits are related to the dependencies on other services used by notebooks.
9190

92-
|Description|Limit |Dependency|
93-
|-------|-------|-------|
94-
| Total count of these assets per machine learning workspace: datasets, runs, models, and artifacts |10 million assets |Azure Machine Learning|
95-
| Default limit for total compute clusters per region. Limit is shared between a training cluster and a compute instance. A compute instance is considered a single-node cluster for quota purposes. | 200 compute clusters per region|Azure Machine Learning|
96-
|Storage accounts per region per subscription|250 storage accounts|Azure Storage|
97-
|Maximum size of a file share by default|5 TB|Azure Storage|
98-
|Maximum size of a file share with large file share feature enabled|100 TB|Azure Storage|
99-
|Maximum throughput (ingress + egress) for a single file share by default|60 MB/sec|Azure Storage|
100-
|Maximum throughput (ingress + egress) for a single file share with large file share feature enabled|300 MB/sec|Azure Storage|
91+
| Description | Limit | Dependency |
92+
| ----------- | ----- | ---------- |
93+
| Total count of these assets per machine learning workspace: datasets, runs, models, and artifacts |10 million assets | Azure Machine Learning |
94+
| Default limit for total compute clusters per region. Limit is shared between a training cluster and a compute instance. A compute instance is considered a single-node cluster for quota purposes. | 200 compute clusters per region | Azure Machine Learning |
95+
| Storage accounts per region per subscription | 250 storage accounts | Azure Storage |
96+
| Maximum size of a file share by default | 5 TB | Azure Storage |
97+
| Maximum size of a file share with large file share feature enabled | 100 TB | Azure Storage |
98+
| Maximum throughput (ingress + egress) for a single file share by default | 60 MB/sec | Azure Storage |
99+
| Maximum throughput (ingress + egress) for a single file share with large file share feature enabled | 300 MB/sec | Azure Storage |
101100

102101
## Repositories limits
103102

104103
The following limits apply to repositories in Microsoft Sentinel.
105104

106-
|Description |Limit |Dependency|
107-
|---------|---------|---------|
108-
|Number of repositories | 5 | Sentinel Workspace|
109-
|Deployment history | 800 | Azure Resource Group |
105+
| Description | Limit | Dependency |
106+
| ----------- | ----- | ---------- |
107+
| Number of repositories | 5 | Sentinel Workspace |
108+
| Deployment history | 800 | Azure Resource Group |
110109

111110
## Threat intelligence limits
112111

113112
The following limit applies to threat intelligence in Microsoft Sentinel. The limit is related to the dependency on an API used by threat intelligence.
114113

115-
|Description | Limit |Dependency|
116-
-------------------------|--------------------|--------------------|
117-
| Indicators per call that use Graph security API | 100 indicators |Microsoft Graph security API|
118-
| CSV TI object file import size | 50MB | none|
119-
| JSON TI object file import size | 250MB | none|
114+
| Description | Limit | Dependency |
115+
| ----------- | ----- | ---------- |
116+
| Indicators per call that use Graph security API | 100 indicators | Microsoft Graph security API |
117+
| CSV TI object file import size | 50MB | none |
118+
| JSON TI object file import size | 250MB | none |
120119

121120
## TI upload API limits
122121

123122
The following limit applies to the threat intelligence upload API in Microsoft Sentinel.
124123

125-
|Description | Limit |Dependency|
126-
-------------------------|--------------------|--------------------|
124+
| Description | Limit | Dependency |
125+
| ----------- | ----- | ---------- |
127126
| STIX objects per request | 100 objects | |
128127
| Requests per minute | 100 | |
129128

130129
## User and Entity Behavior Analytics (UEBA) limits
131130

132131
The following limit applies to UEBA in Microsoft Sentinel. The limit for UEBA in Microsoft Sentinel is related to dependencies on another service.
133132

134-
|Description |Limit |Dependency|
135-
|---------|---------|---------|
136-
|Lowest retention configuration in days for the [IdentityInfo](/azure/azure-monitor/reference/tables/identityinfo) table. All data stored on the IdentityInfo table in Log Analytics is refreshed every 14 days. | 14 days |Log Analytics|
133+
| Description | Limit | Dependency |
134+
| ----------- | ----- | ---------- |
135+
| Lowest retention configuration in days for the [IdentityInfo](/azure/azure-monitor/reference/tables/identityinfo) table. All data stored on the IdentityInfo table in Log Analytics is refreshed every 14 days. | 14 days | Log Analytics |
136+
| Groups listed in the *GroupMembership* field in the [IdentityInfo](ueba-reference.md#identityinfo-table) table (including subgroups) | 500 | |
137137

138138
## Watchlist limits
139139

140140
The following limits apply to watchlists in Microsoft Sentinel. The limits are related to the dependencies on other services used by watchlists.
141141

142-
|Description | Limit |Dependency|
143-
|--|-------------------------|--------------------|
144-
|Upload size limit for local file</br>files over this limit are considered `large`| 3.8 MB per file |Azure Resource Manager
145-
|Line entry in the CSV file |10,240 characters per line|Azure Resource Manager|
146-
|Total size of a single row | 10 Kb | Log Analytics|
147-
|Upload size for large watchlist files in Azure Storage |500 MB per file|Azure Storage|
148-
|Total number of active watchlist items per workspace</br>When the max count is reached, delete some existing items to add a new watchlist.|10 million active watchlist items|Log Analytics|
149-
|Total rate of change of all watchlist items per workspace</br>(create, update, and delete operations) | 100,000 changes per month</br>(1% of max active watchlist items)|Log Analytics|
150-
|Number of `large` watchlist uploads per workspace at a time</br>See upload size limit for what makes a watchlist `large` |One `large` watchlist | Azure Cosmos DB|
151-
|Number of large watchlist deletions per workspace at a time</br>See upload size limit for what makes a watchlist `large` | One `large` watchlist | Azure Cosmos DB|
142+
| Description | Limit | Dependency |
143+
| ----------- | ----- | ---------- |
144+
| Upload size limit for local file</br>files over this limit are considered `large`| 3.8 MB per file | Azure Resource Manager |
145+
| Line entry in the CSV file | 10,240 characters per line | Azure Resource Manager |
146+
| Total size of a single row | 10 Kb | Log Analytics |
147+
| Upload size for large watchlist files in Azure Storage | 500 MB per file | Azure Storage |
148+
| Total number of active watchlist items per workspace</br>When the max count is reached, delete some existing items to add a new watchlist. | 10 million active watchlist items | Log Analytics |
149+
| Total rate of change of all watchlist items per workspace</br>(create, update, and delete operations) | 100,000 changes per month</br>(1% of max active watchlist items) | Log Analytics |
150+
| Number of `large` watchlist uploads per workspace at a time</br>See upload size limit for what makes a watchlist `large` | One `large` watchlist | Azure Cosmos DB |
151+
| Number of large watchlist deletions per workspace at a time</br>See upload size limit for what makes a watchlist `large` | One `large` watchlist | Azure Cosmos DB |
152152

153153
## Workbook limits
154154

@@ -158,9 +158,9 @@ Workbook limits for Sentinel are the same result limits found in Azure Monitor.
158158

159159
The following limits apply to workspace manager in Microsoft Sentinel.
160160

161-
|Description | Limit |Dependency|
162-
|--|-------------------------|--------------------|
163-
|Number of published operations in a group<br>*Published operations* = (*member workspaces*) * (*content items*)| 2000 published operations |None|
161+
| Description | Limit | Dependency |
162+
| ----------- | ----- | ---------- |
163+
| Number of published operations in a group<br>*Published operations* = (*member workspaces*) * (*content items*) | 2000 published operations | None |
164164

165165
## Next steps
166166

‎articles/sentinel/ueba-reference.md

Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -209,21 +209,38 @@ The following tables describe the enrichments featured in the **ActivityInsights
209209

210210
### IdentityInfo table
211211

212-
After you [enable UEBA](enable-entity-behavior-analytics.md) for your Microsoft Sentinel workspace, data from your Microsoft Entra ID is synchronized to the **IdentityInfo** table in Log Analytics for use in Microsoft Sentinel. You can embed user data synchronized from your Microsoft Entra ID in your analytics rules to enhance your analytics to fit your use cases and reduce false positives.
212+
After you [enable and configure UEBA](enable-entity-behavior-analytics.md) for your Microsoft Sentinel workspace, data from your Microsoft identity providers is synchronized to the *IdentityInfo* table in Log Analytics for use in Microsoft Sentinel.
213+
214+
Those identity providers are either or both of the following, depending on which you selected when you configured UEBA:
215+
216+
- Microsoft Entra ID (cloud-based)
217+
- Microsoft Active Directory (on-premises, requires Microsoft Defender for Identity))
218+
219+
You can query the *IdentityInfo* table in analytics rules, hunting queries, and workbooks, enhancing your analytics to fit your use cases and reducing false positives.
213220

214221
While the initial synchronization may take a few days, once the data is fully synchronized:
215222

216-
- Changes made to your user profiles, groups, and roles in Microsoft Entra ID are updated in the **IdentityInfo** table within 15-30 minutes.
223+
- Every 14 days, Microsoft Sentinel re-synchronizes with your entire Microsoft Entra ID (and your on-premises Active Directory, if applicable) to ensure that stale records are fully updated.
224+
225+
- Besides these regular full synchronizations, whenever changes are made to your user profiles, groups, and built-in roles in Microsoft Entra ID, the affected user records are re-ingested and updated in the *IdentityInfo* table within 15-30 minutes. This ingestion is billed at regular rates. For example:
217226

218-
- Every 14 days, Microsoft Sentinel re-synchronizes with your entire Microsoft Entra ID to ensure that stale records are fully updated.
227+
- A user attribute, such as display name, job title, or email address, was changed. A new record for this user is ingested into the *IdentityInfo* table, with the relevant fields updated.
219228

220-
- Default retention time in the **IdentityInfo** table is 30 days.
229+
- Group A has 100 users in it. 5 users are added to the group or removed from the group. In this case, those 5 user records are re-ingested, and their *GroupMembership* fields updated.
230+
231+
- Group A has 100 users in it. Ten users are added to Group A. Also, groups A1 and A2, each with 10 users, are added to Group A. In this case, 30 user records are re-ingested and their *GroupMembership* fields updated. This happens because group membership is transitive, so changes to groups affect all their subgroups.
232+
233+
- Group B (with 50 users) is renamed to Group BeGood. In this case, 50 user records are re-ingested and their *GroupMembership* fields updated. If there are subgroups in that group, the same happens for all their members' records.
234+
235+
- Default retention time in the *IdentityInfo* table is 30 days.
221236

222237
#### Limitations
223238

224-
- Currently, only built-in roles are supported.
239+
- The *AssignedRoles* field supports only built-in roles.
240+
241+
- The *GroupMembership* field supports listing up to 500 groups per user, including subgroups. If a user is a member of more than 500 groups, only the first 500 are synchronized with the *IdentityInfo* table. The groups are not evaluated in any particular order, though, so at each new synchronization (every 14 days), it's possible that a different set of groups will be updated to the user record.
225242

226-
- Data about deleted groups, where a user was removed from a group, is not currently supported.
243+
- When a group is deleted, or if a group with more than 100 members has its name changed, that group's member user records are not updated. If a different change causes one of those users' records to be updated, the updated group information will be included at that point.
227244

228245
#### Versions of the IdentityInfo table
229246

@@ -249,7 +266,7 @@ The following table describes the user identity data included in the **IdentityI
249266
| **AccountTenantId** | string | The Microsoft Entra tenant ID of the user account. | -- |
250267
| **AccountUPN** | string | The user principal name of the user account. | AccountUPN |
251268
| **AdditionalMailAddresses** | dynamic | The additional email addresses of the user. | -- |
252-
| **AssignedRoles** | dynamic | The Microsoft Entra roles the user account is assigned to. | AssignedRoles |
269+
| **AssignedRoles** | dynamic | The Microsoft Entra roles the user account is assigned to. Only built-in roles are supported. | AssignedRoles |
253270
| **BlastRadius** | string | A calculation based on the position of the user in the org tree and the user's Microsoft Entra roles and permissions. <br>Possible values: *Low, Medium, High* | -- |
254271
| **ChangeSource** | string | The source of the latest change to the entity. <br>Possible values: <li>*AzureActiveDirectory*<li>*ActiveDirectory*<li>*UEBA*<li>*Watchlist*<li>*FullSync* | ChangeSource |
255272
| **CompanyName** | | The company name to which the user belongs. | -- |

0 commit comments

Comments
 (0)