Question

Your SOC wants Microsoft Sentinel to automatically build behavioral baselines for users and hosts so that anomaly-based detections (such as anomalous sign-in or unusual resource access) can surface deviations from normal activity. An analyst asks what must be configured first so that these entity behavior insights and the associated BehaviorAnalytics table are populated. What should you do?

Accepted Answer

Enable User and Entity Behavior Analytics (UEBA) in Sentinel settings and select the relevant data sources such as Azure AD sign-in and audit logs

Answer

Create a scheduled analytics rule that queries the SigninLogs table with a 14-day lookback window

Answer

Deploy the Azure Monitor Agent to all domain controllers and configure a data collection rule for security events

Answer

Turn on the Fusion advanced multistage attack detection rule in the Analytics blade