New data sources for UEBA behaviors and anomaly detection (Preview)
Analysis / inference: Microsoft Sentinel has expanded its UEBA capabilities to include behavioral and anomaly detection for Fortinet, Check Point, Zscaler, and AWS GuardDuty data sources.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Sentinel - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Added support for Fortinet FortiGate events in the UEBA behaviors layer and introduced ten new anomaly detection rules for firewall, VPN, and web proxy events, plus support for AWS GuardDuty findings.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisExpanding UEBA coverage to include common network security appliances like Fortinet, Check Point, and Zscaler improves the ability to detect lateral movement, unauthorized configuration changes, and compromised credentials within the network perimeter.
Security analysts gain automated detection of suspicious administrative activity, anomalous VPN sign-ins, and high-risk web access, mapped to specific MITRE ATT&CK techniques.
Section 03 · Recommended actions
- Enable the new anomaly rules within the Microsoft Sentinel UEBA settings.
- Review the MITRE ATT&CK mappings for the new behaviors to update internal incident response playbooks.
- Verify log ingestion health for the newly supported data sources.
- Verify that Fortinet FortiGate, Check Point, and Zscaler logs are correctly ingested into the CommonSecurityLog table.
- Review the new UEBA behavior and anomaly rules in the Microsoft Sentinel UEBA configuration blade.
- Ensure AWS GuardDuty logs are correctly ingested into the AWSGuardDuty table to leverage the new identity-linked anomaly detections.