Microsoft Defender for Cloud Apps: Behaviors

Originally posted by Microsoft Apr 5, 2023 Uncategorized 0 Comments

A new data type in Microsoft 365 Defender Advanced Hunting. Behaviors will optimize the alerts queue by enabling security teams to focus on the most relevant alerts in their environment. They will indicate what took place in a descriptive form, attached to the MITRE tactics and techniques that are common measure most organizations follow and test their coverage against. This new data type which sits between the raw data and alert, will enable your security teams to prioritize critical alerts in your environment without having to compromise contextual information provided in a behavior that may be important to an investigation. The behaviors data will also enrich the context of related incidents and only correlate anomalies when relevant. Within Defender for Cloud Apps, we have identified some detections that are better suited as behaviors, and we are transforming them to the new data type to reflect it that can be retrieved via advanced hunting.

Product
Release phase	Preview
Release date	August CY2023 Preview date: March CY2023
Platform	Web
Cloud Instance	Worldwide (Standard Multi-Tenant)
Created	2023-04-05
Roadmap ID	124789
Roadmap Link	https://www.microsoft.com/microsoft-365/roadmap?featureid=124789