Identity / Authentication and sign-in
BehaviorAnalytics
User and Entity Behavior Analytics results showing anomalous activities and risk scores
Recommendation
High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.
How the matrix worksC8 Behavior analytics, threat intelligence, and identity inventory
Behavior analytics, threat intelligence, and identity inventory used by detections
ACSC
No section
CISA
- 1. Identity, credential, and access management (ICAM)1a Identity attributes
MITRE data sources
- User Account: Authentication
T1 Near-real-time detection
Generic detections need near-real-time matching on single events.
No lake support in the Azure Monitor table feature matrix
Fields detections use
High-value fields
Most used in public rules
UserPrincipalName35ActivityType34ActivityInsights33SourceIPAddress31UsersInsights30TimeGenerated29DevicesInsights27ActionType22InvestigationPriority21SourceIPLocation18UserName16SourceDevice14
Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.