Skip to content

Commit dc6acf2

Browse files
authored
Update ueba-reference.md
1 parent 61a7fca commit dc6acf2

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

articles/sentinel/ueba-reference.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -225,9 +225,13 @@ While the initial synchronization may take a few days, once the data is fully sy
225225

226226
#### Versions of the IdentityInfo table
227227

228-
There are actually two versions of the *IdentityInfo* table: one serving Microsoft Sentinel, in the *Log Analytics* schema, the other serving the Microsoft Defender portal via Microsoft Defender for Identity, in what's known as the *Advanced hunting* schema. Both versions of this table are fed by Microsoft Entra ID, but the Log Analytics version added a few fields.
228+
There are actually two versions of the *IdentityInfo* table:
229+
- The *Log Analytics* schema version serves Microsoft Sentinel in the Azure portal.
230+
- The *Advanced hunting* schema version serves Microsoft Sentinel in the Microsoft Defender portal via Microsoft Defender for Identity.
229231

230-
[The unified security operations platform in the Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2263690) uses the *Advanced hunting* version of this table, so, to minimize the differences between the versions of the table, most of the unique fields in the Log Analytics version are gradually being added to the *Advanced hunting* version as well. Regardless of in which portal you're using Microsoft Sentinel, you'll have access to nearly all the same information, though there may be a small time lag in synchronization between the versions. For more information, see the [documentation of the *Advanced hunting* version of this table](/defender-xdr/advanced-hunting-identityinfo-table).
232+
Both versions of this table are fed by Microsoft Entra ID, but the Log Analytics version added a few fields.
233+
234+
[The unified security operations platform](https://go.microsoft.com/fwlink/p/?linkid=2263690), being in the Defender portal, uses the *Advanced hunting* version of this table. To minimize the differences between the two versions of the table, most of the unique fields in the Log Analytics version are gradually being added to the *Advanced hunting* version as well. Regardless of in which portal you're using Microsoft Sentinel, you'll have access to nearly all the same information, though there may be a small time lag in synchronization between the versions. For more information, see the [documentation of the *Advanced hunting* version of this table](/defender-xdr/advanced-hunting-identityinfo-table).
231235

232236
The following table describes the user identity data included in the **IdentityInfo** table in Log Analytics in the Azure portal. The fourth column shows the corresponding fields in the *Advanced hunting* version of the table, that Microsoft Sentinel uses in the Defender portal. Field names in boldface are named differently in the *Advanced hunting* schema than they are in the Microsoft Sentinel Log Analytics version.
233237

0 commit comments

Comments
 (0)