UEBA enhancements: New settings experience, Okta V2 support, and more GCP anomaly detections
Analysis / inference: Microsoft Sentinel rolled out a consolidated UEBA settings experience, added Okta V2 support for existing anomaly detections, and introduced five new GCP Audit Logs anomaly rules.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Sentinel - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
A unified entry point for UEBA and Behaviors settings was added to the Microsoft Sentinel settings page. In addition, existing UEBA Okta anomalies now ingest data from the OktaV2_CL table in parallel with Okta_CL, and five new GCP Audit Logs anomaly detections covering unusual logins, privileged actions, resource deployments, secret/KMS key access, and infrastructure usage were introduced.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisSOC engineers relying on UEBA telemetry need to update their configuration workflows and ensure Okta V2 and new Google Cloud Platform log tables are properly mapped to support anomaly detection logic.
Settings management for UEBA is streamlined into a single location, and existing Okta and GCP log streams gain enhanced or newly supported anomaly coverage without requiring new rule creations.
Section 03 · Recommended actions
- Navigate to the new UEBA tab in Microsoft Sentinel settings to manage configurations
- Validate that Okta V2 log structures map properly to the updated UEBA anomaly rules
- Review and enable the newly available GCP Audit Logs anomaly detections based on organizational threat models
- Verify whether your environment is using the newer OktaV2_CL table for UEBA anomaly rules
- Check the new consolidated UEBA and Behaviors settings tab in the Microsoft Sentinel settings page
- Review the five new GCP Audit Logs anomaly detections for applicability to your multi-cloud monitoring scope