You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/ueba-reference.md
+97-54Lines changed: 97 additions & 54 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -209,13 +209,13 @@ The following tables describe the enrichments featured in the **ActivityInsights
209
209
210
210
### IdentityInfo table
211
211
212
-
After you [enable UEBA](enable-entity-behavior-analytics.md) for your Microsoft Sentinel workspace, data from your Microsoft Entra ID is synchronized to the **IdentityInfo** table in Log Analytics for use in Microsoft Sentinel. You can embed user data synchronized from your Microsoft Entra ID in your analytics rules to enhance your analytics to fit your use cases and reduce false positives.
212
+
After you [enable UEBA](enable-entity-behavior-analytics.md) for your Microsoft Sentinel workspace, user data from your Microsoft Entra ID (and/or your on-premises Active Directory, via Microsoft Defender for Identity) ***(and other identity providers -- Okta etc.?)***is synchronized to the **IdentityInfo** table in Log Analytics for use in Microsoft Sentinel. You can query this data in your analytics rules, enriching your analytics to fit your use cases and reduce false positives.
213
213
214
214
While the initial synchronization may take a few days, once the data is fully synchronized:
215
215
216
-
- Changes made to your user profiles, groups, and roles in Microsoft Entra ID are updated in the **IdentityInfo** table within 15-30 minutes.
216
+
- Changes made to your user profiles, groups, and roles in Microsoft Entra ID ***(and on-prem Active Directory? And other identity providers -- Okta etc.?)***are updated in the **IdentityInfo** table within 15-30 minutes.
217
217
218
-
- Every 14 days, Microsoft Sentinel re-synchronizes with your entire Microsoft Entra ID to ensure that stale records are fully updated.
218
+
- Every 14 days, Microsoft Sentinel re-synchronizes with your entire Microsoft Entra ID ***(and other providers?)***to ensure that stale records are fully updated.
219
219
220
220
- Default retention time in the **IdentityInfo** table is 30 days.
221
221
@@ -225,57 +225,100 @@ While the initial synchronization may take a few days, once the data is fully sy
225
225
226
226
- Data about deleted groups, where a user was removed from a group, is not currently supported.
227
227
228
-
#### Versions of the IdentityInfo table
229
-
230
-
There are actually two versions of the *IdentityInfo* table:
231
-
- The *Log Analytics* schema version serves Microsoft Sentinel in the Azure portal.
232
-
- The *Advanced hunting* schema version serves Microsoft Sentinel in the Microsoft Defender portal via Microsoft Defender for Identity.
233
-
234
-
Both versions of this table are fed by Microsoft Entra ID, but the Log Analytics version added a few fields.
235
-
236
-
[Microsoft Sentinel in the Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2263690), uses the *Advanced hunting* version of this table. To minimize the differences between the two versions of the table, most of the unique fields in the Log Analytics version are gradually being added to the *Advanced hunting* version as well. Regardless of in which portal you're using Microsoft Sentinel, you'll have access to nearly all the same information, though there may be a small time lag in synchronization between the versions. For more information, see the [documentation of the *Advanced hunting* version of this table](/defender-xdr/advanced-hunting-identityinfo-table).
237
-
238
-
The following table describes the user identity data included in the **IdentityInfo** table in Log Analytics in the Azure portal. The fourth column shows the corresponding fields in the *Advanced hunting* version of the table, that Microsoft Sentinel uses in the Defender portal. Field names in boldface are named differently in the *Advanced hunting* schema than they are in the Microsoft Sentinel Log Analytics version.
239
-
240
-
| Field name in<br>*Log Analytics* schema | Type | Description | Field name in<br>*Advanced hunting* schema |
|**AccountCloudSID**| string | The Microsoft Entra security identifier of the account. |**CloudSid**|
243
-
|**AccountCreationTime**| datetime | The date the user account was created (UTC). |**CreatedDateTime**|
244
-
|**AccountDisplayName**| string | The display name of the user account. | AccountDisplayName |
245
-
|**AccountDomain**| string | The domain name of the user account. | AccountDomain |
246
-
|**AccountName**| string | The user name of the user account. | AccountName |
247
-
|**AccountObjectId**| string | The Microsoft Entra object ID for the user account. | AccountObjectId |
248
-
|**AccountSID**| string | The on-premises security identifier of the user account. | AccountSID |
249
-
|**AccountTenantId**| string | The Microsoft Entra tenant ID of the user account. | -- |
250
-
|**AccountUPN**| string | The user principal name of the user account. | AccountUPN |
251
-
|**AdditionalMailAddresses**| dynamic | The additional email addresses of the user. | -- |
252
-
|**AssignedRoles**| dynamic | The Microsoft Entra roles the user account is assigned to. | AssignedRoles |
253
-
|**BlastRadius**| string | A calculation based on the position of the user in the org tree and the user's Microsoft Entra roles and permissions. <br>Possible values: *Low, Medium, High*| -- |
254
-
|**ChangeSource**| string | The source of the latest change to the entity. <br>Possible values: <li>*AzureActiveDirectory*<li>*ActiveDirectory*<li>*UEBA*<li>*Watchlist*<li>*FullSync*| ChangeSource |
255
-
|**CompanyName**|| The company name to which the user belongs. | -- |
256
-
|**City**| string | The city of the user account. | City |
257
-
|**Country**| string | The country/region of the user account. | Country |
258
-
|**DeletedDateTime**| datetime | The date and time the user was deleted. | -- |
259
-
|**Department**| string | The department of the user account. | Department |
260
-
|**GivenName**| string | The given name of the user account. | GivenName |
261
-
|**GroupMembership**| dynamic | Microsoft Entra groups where the user account is a member. | -- |
262
-
|**IsAccountEnabled**| bool | An indication as to whether the user account is enabled in Microsoft Entra ID or not. | IsAccountEnabled |
263
-
|**JobTitle**| string | The job title of the user account. | JobTitle |
264
-
|**MailAddress**| string | The primary email address of the user account. |**EmailAddress**|
265
-
|**Manager**| string | The manager alias of the user account. | Manager |
266
-
|**OnPremisesDistinguishedName**| string | The Microsoft Entra ID distinguished name (DN). A distinguished name is a sequence of relative distinguished names (RDN), connected by commas. |**DistinguishedName**|
267
-
|**Phone**| string | The phone number of the user account. | Phone |
268
-
|**SourceSystem**| string | The system where the user is managed. <br>Possible values: <li>*AzureActiveDirectory*<li>*ActiveDirectory*<li>*Hybrid*|**SourceProvider**|
269
-
|**State**| string | The geographical state of the user account. | State |
270
-
|**StreetAddress**| string | The office street address of the user account. |**Address**|
271
-
|**Surname**| string | The surname of the user. account. | Surname |
272
-
|**TenantId**| string | The tenant ID of the user. | -- |
273
-
|**TimeGenerated**| datetime | The time when the event was generated (UTC). |**Timestamp**|
274
-
|**Type**| string | The name of the table. | -- |
275
-
|**UserAccountControl**| dynamic | Security attributes of the user account in the AD domain. <br> Possible values (may contain more than one):<li>*AccountDisabled*<li>*HomedirRequired*<li>*AccountLocked*<li>*PasswordNotRequired*<li>*CannotChangePassword*<li>*EncryptedTextPasswordAllowed*<li>*TemporaryDuplicateAccount*<li>*NormalAccount*<li>*InterdomainTrustAccount*<li>*WorkstationTrustAccount*<li>*ServerTrustAccount*<li>*PasswordNeverExpires*<li>*MnsLogonAccount*<li>*SmartcardRequired*<li>*TrustedForDelegation*<li>*DelegationNotAllowed*<li>*UseDesKeyOnly*<li>*DontRequirePreauthentication*<li>*PasswordExpired*<li>*TrustedToAuthenticationForDelegation*<li>*PartialSecretsAccount*<li>*UseAesKeys*| -- |
276
-
|**UserState**| string | The current state of the user account in Microsoft Entra ID.<br>Possible values:<li>*Active*<li>*Disabled*<li>*Dormant*<li>*Lockout*| -- |
277
-
|**UserStateChangedOn**| datetime | The date of the last time the account state was changed (UTC). | -- |
278
-
|**UserType**| string | The user type. | -- |
228
+
#### Other versions of the IdentityInfo table
229
+
230
+
There are actually multiple versions of the *IdentityInfo* table:
231
+
232
+
- The **Log Analytics** schema version, discussed in this article, serves Microsoft Sentinel in the Azure portal. It's available to those customers who enabled UEBA.
233
+
234
+
- The **Advanced hunting** schema version serves the Microsoft Defender portal via Microsoft Defender for Identity. It's available to customers of Microsoft Defender XDR, with or without Microsoft Sentinel, and to customers of Microsoft Sentinel by itself in the Defender portal.
235
+
236
+
UEBA doesn't have to be enabled in order to have access to this table. However, for customers without UEBA enabled, the fields populated by UEBA data aren't visible or available.
237
+
238
+
For more information, see the [documentation of the *Advanced hunting* version of this table](/defender-xdr/advanced-hunting-identityinfo-table).
239
+
240
+
-**As of February 2025**, customers of [Microsoft Sentinel in the Microsoft Defender portal](microsoft-sentinel-defender-portal.md)*with UEBA enabled***begin using a new release** of the *Advanced hunting* version. This new release includes all the UEBA fields from the Log Analytics version as well as some new fields, and is referred to as the **unified version** or the **unified IdentityInfo table**.
241
+
242
+
Defender portal customers without UEBA enabled, or without Microsoft Sentinel at all, continue to use the [prior release of the *Advanced hunting* version](/defender-xdr/advanced-hunting-identityinfo-table), without the UEBA-generated fields.
243
+
244
+
For more information on the unified version, see [Unified IdentityInfo table reference](/unified-secops-platform/unified-identityinfo-table-reference).
245
+
246
+
#### Schema
247
+
248
+
The table in the following "Log Analytics schema" tab describes the user identity data included in the **IdentityInfo** table in Log Analytics in the Azure portal.
249
+
250
+
If you're onboarding Microsoft Sentinel to the Defender portal, select the "Compare to unified schema" tab to view the changes that could potentially affect the queries in your threat detection rules and hunts.
|**AccountCloudSID**| string | The Microsoft Entra security identifier of the account. |
257
+
|**AccountCreationTime**| datetime | The date the user account was created (UTC). |
258
+
|**AccountDisplayName**| string | The display name of the user account. |
259
+
|**AccountDomain**| string | The domain name of the user account. |
260
+
|**AccountName**| string | The user name of the user account. |
261
+
|**AccountObjectId**| string | The Microsoft Entra object ID for the user account. |
262
+
|**AccountSID**| string | The on-premises security identifier of the user account. |
263
+
|**AccountTenantId**| string | The Microsoft Entra tenant ID of the user account. |
264
+
|**AccountUPN**| string | The user principal name of the user account. |
265
+
|**AdditionalMailAddresses**| dynamic | The additional email addresses of the user. |
266
+
|**AssignedRoles**| dynamic | The Microsoft Entra roles the user account is assigned to. |
267
+
|**BlastRadius**| string | A calculation based on the position of the user in the org tree and the user's Microsoft Entra roles and permissions. <br>Possible values: *Low, Medium, High*|
268
+
|**ChangeSource**| string | The source of the latest change to the entity. <br>Possible values: <li>*AzureActiveDirectory*<li>*ActiveDirectory*<li>*UEBA*<li>*Watchlist*<li>*FullSync*|
269
+
|**City**| string | The city of the user account. |
270
+
|**CompanyName**| string | The company name to which the user belongs. |
271
+
|**Country**| string | The country/region of the user account. |
272
+
|**DeletedDateTime**| datetime | The date and time the user was deleted. |
273
+
|**Department**| string | The department of the user account. |
274
+
|**EmployeeId**| string | The employee identifier assigned to the user by the organization. |
275
+
|**GivenName**| string | The given name of the user account. |
276
+
|**GroupMembership**| dynamic | Microsoft Entra ID groups where the user account is a member. |
277
+
|**IsAccountEnabled**| bool | An indication as to whether the user account is enabled in Microsoft Entra ID or not. |
278
+
|**JobTitle**| string | The job title of the user account. |
279
+
|**MailAddress**| string | The primary email address of the user account. |
280
+
|**Manager**| string | The manager alias of the user account. |
281
+
|**OnPremisesDistinguishedName**| string | The Microsoft Entra ID distinguished name (DN). A distinguished name is a sequence of relative distinguished names (RDN), connected by commas. |
282
+
|**Phone**| string | The phone number of the user account. |
283
+
|**RiskLevel**| string | The Microsoft Entra ID risk level of the user account. <br>Possible values: <li>*Low*<li>*Medium*<li>*High*|
284
+
|**RiskLevelDetails**| string | Details regarding the Microsoft Entra ID risk level. |
285
+
|**RiskState**| string | Indication if the account is at risk now or if the risk was remediated. |
286
+
|**SourceSystem**| string | The system where the user is managed. <br>Possible values: <li>*AzureActiveDirectory*<li>*ActiveDirectory*<li>*Hybrid*|
287
+
|**State**| string | The geographical state of the user account. |
288
+
|**StreetAddress**| string | The office street address of the user account. |
289
+
|**Surname**| string | The surname of the user. account. |
290
+
|**TenantId**| string | The tenant ID of the user. |
291
+
|**TimeGenerated**| datetime | The time when the event was generated (UTC). |
292
+
|**Type**| string | The name of the table. |
293
+
|**UserAccountControl**| dynamic | Security attributes of the user account in the AD domain. <br> Possible values (may contain more than one):<li>*AccountDisabled*<li>*HomedirRequired*<li>*AccountLocked*<li>*PasswordNotRequired*<li>*CannotChangePassword*<li>*EncryptedTextPasswordAllowed*<li>*TemporaryDuplicateAccount*<li>*NormalAccount*<li>*InterdomainTrustAccount*<li>*WorkstationTrustAccount*<li>*ServerTrustAccount*<li>*PasswordNeverExpires*<li>*MnsLogonAccount*<li>*SmartcardRequired*<li>*TrustedForDelegation*<li>*DelegationNotAllowed*<li>*UseDesKeyOnly*<li>*DontRequirePreauthentication*<li>*PasswordExpired*<li>*TrustedToAuthenticationForDelegation*<li>*PartialSecretsAccount*<li>*UseAesKeys*|
294
+
|**UserState**| string | The current state of the user account in Microsoft Entra ID.<br>Possible values:<li>*Active*<li>*Disabled*<li>*Dormant*<li>*Lockout*|
295
+
|**UserStateChangedOn**| datetime | The date of the last time the account state was changed (UTC). |
296
+
|**UserType**| string | The user type. |
297
+
298
+
# [Unified table](#tab/unified-table)
299
+
300
+
The following fields have been renamed in the unified version. Therefore, if you're onboarding Microsoft Sentinel to the Defender portal, check your queries for any references to these fields, and update them if necessary.
301
+
302
+
| Log Analytics field name | Unified schema field name | Comments |
0 commit comments