Merge branch 'main' into AHtimeilne

Author: mberdugo

defender-xdr/investigate-incidents.md

@@ -87,8 +87,9 @@ The ***go hunt*** action takes advantage of the [advanced hunting](advanced-hunt
   - See all available queries – the option returns all available queries for the entity type you're investigating.
   - All Activity – the query returns all activities associated with an entity, providing you with a comprehensive view of the incident's context.
   - Related Alerts – the query searches for and returns all security alerts involving a specific entity, ensuring you don't miss any information.
+  - All User anomalies (Preview) – the query returns all anomalies associated with the user from the past 30 days, helping you identify unusual behavior that might be relevant to the incident. Available only for user entities if you have enabled [Microsoft Sentinel User and Entity Behavior Analytics (UEBA)](/azure/sentinel/identify-threats-with-entity-behavior-analytics).
 
-:::image type="content" source="./media/investigate-incidents/fig1-gohunt-attackstory.png" alt-text="Selecting the go hunt option on a device in an attack story" lightbox="./media/investigate-incidents/fig1-gohunt-attackstory.png":::
+:::image type="content" source="./media/investigate-incidents/gohunt-attackstory.png" alt-text="Selecting the go hunt option on a device in an attack story" lightbox="./media/investigate-incidents/gohunt-attackstory.png":::
 
 The resulting logs or alerts can be linked to an incident by selecting a result and then selecting *Link to incident*.
 

defender-xdr/investigate-users.md

@@ -57,17 +57,20 @@ The identity page shows the Microsoft Entra organization and groups, helping you
 
 ### Entity details
 
-The **Entity details** panel on the left side of the page provides information about the user, such as the Microsoft Entra identity risk level, the insider risk severity level (Preview), the number of devices the user is signed in to, when the user was first and last seen, the user's accounts, groups that the user belongs to, contact information, and more. You see other details depending on the integration features you enabled.
+The **Entity details** panel on the left side of the page provides information about the user, such as the Microsoft Entra identity risk level, the insider risk severity level (Preview), the number of devices the user is signed in to, when the user was first and last seen, the user's accounts, groups that the user belongs to, and contact information. This card includes all incidents and alerts associated with the user entity, grouped by severity.
 
 > [!NOTE]
 > **Investigation Priority Score** was deprecated on December 3, 2024. The Investigation Priority Score breakdown and the Scored activities cards are no longer available.
 
-> [!NOTE]
-> (Preview) Microsoft Defender XDR users with access to [Microsoft Purview Insider Risk Management](/purview/insider-risk-management-solution-overview) can now see a user's insider risk severity and gain insights on a user's suspicious activities in the user page. Select the **insider risk severity** under Entity details to see the risk insights about the user.
-### Visual view of incidents and alerts
+You see other details depending on the services and features you enabled, including: 
 
-This card includes all incidents and alerts associated with the user entity, grouped by severity.
+- (Preview) Microsoft Defender XDR users with access to [Microsoft Purview Insider Risk Management](/purview/insider-risk-management-solution-overview) can now see a user's insider risk severity and gain insights on a user's suspicious activities in the user page. Select the **insider risk severity** under Entity details to see the risk insights about the user.
+- (Preview) If you enable [Microsoft Sentinel User and Entity Behavior Analytics (UEBA)](/azure/sentinel/identify-threats-with-entity-behavior-analytics), you'll see:
+    - The user's top three UEBA anomalies from the last 30 days.
+    - Links to launch pre-built advanced hunting queries and view all anomalous behaviors related to the user on the [Sentinel events tab](#microsoft-sentinel-events). 
+  This is available only for customers who have UEBA enabled. 
 
+   
 ### Active directory account controls
 
 This card highlights important Microsoft Defender for Identity security settings for the user's account. For example, it shows if the user can bypass the password by pressing enter, or if the user's password never expires. Review these flags to identify account settings that might need your attention.

defender-xdr/media/investigate-incidents/fig1-gohunt-attackstory.png

@@ -22,6 +22,35 @@ ms.topic: concept-article
 This article lists recent features added for unified security operations in the Microsoft Defender portal.
 
 
+## November 2025
+
+### New Entity Behavior Analytics (UEBA) experiences in the Defender portal (Preview)
+
+Microsoft Sentinel introduces new UEBA experiences in the Defender portal, bringing behavioral insights directly into key analyst workflows. These enhancements help analysts prioritize investigations and apply UEBA context more effectively.
+
+#### Anomaly-focused user investigations
+
+In the Defender portal, users with behavioral anomalies are automatically tagged with **UEBA Anomalies**, helping analysts quickly identify which users to prioritize.
+
+Analysts can view the top three anomalies from the past 30 days in a dedicated Top UEBA anomalies section, available in:
+
+- User side panels accessible from various portal locations.
+- The **Overview** tab of user entity pages.
+
+This section also includes direct links to anomaly queries and the Sentinel events timeline, enabling deeper investigation and faster context gathering.
+
+#### Drilldown to user anomalies from incident graphs
+
+Analysts can quickly access all anomalies related to a user by selecting **Go Hunt > All user anomalies** from the incident graph. This built-in query provides immediate UEBA context to support deeper investigation.
+
+#### Enriched advanced hunting and custom detections queries with behavior insights
+
+Advanced hunting and custom detection experiences now include a contextual banner that prompts analysts to join the UEBA Anomalies table to queries that include UEBA data sources.  
+
+All features require UEBA to be enabled and are workspace-scoped to the currently selected workspace.
+
+For more information, see [UEBA experiences in the Defender portal empower analysts and streamline workflows](/azure/sentinel/identify-threats-with-entity-behavior-analytics.md#ueba-experiences-in-the-defender-portal-empower-analysts-and-streamline-workflows).
+
 ## September 2025