In modern cloud environments, security teams are overwhelmed with massive volumes of telemetry. AWS CloudTrail alone generates an enormous stream of logs, making it difficult to distinguish benign activity from real threats. This is where User and Entity Behavior Analytics (UEBA), as implemented in Microsoft Sentinel, transforms the investigation landscape. This blog explores how UEBA enrichments, anomaly detection, and behavioral context elevate AWS security monitoring from raw log analysis to actionable intelligence.
Understanding the BehaviorAnalytics Table
At the core of UEBA-driven investigations lies the BehaviorAnalytics table, the primary surface for analyzing enriched AWS activity. This table consolidates raw CloudTrail logs with behavioral insights, enabling analysts to work with context rather than isolated events.
Key fields include:
- EventSource: Identifies the origin (e.g., AWS CloudTrail)
- ActivityType: Maps to AWS services like S3, IAM, or KMS
- ActionType: Captures specific API calls such as
ConsoleLoginorCreateUser
What makes this table powerful is its dynamic enrichment fields:
- UserInsights
- DeviceInsights
- ActivityInsights
Among these, ActivityInsights stands out as a JSON-based property bag containing binary behavioral features (true/false indicators). These features are computed across multiple baselines ranging from 7 to 180 days, offering deep historical context.
The Role of the Anomalies Table
Complementing BehaviorAnalytics is the Anomalies table, which contains outputs from Microsoft’s machine learning models.
Each anomaly record includes:
- AnomalyScore (0–1)
- AnomalyReasons explaining why the activity is suspicious
- MITRE ATT&CK mappings for threat classification
For example, an IAM privilege modification anomaly might highlight:
- First-time action by a user
- Login from a new country
- Use of an uncommon browser or user agent
These signals are not guesses—they are derived from learned behavioral baselines, giving analysts a reliable starting point for investigation.
Traditional Log Analysis vs UEBA-Driven Detection
The Traditional Approach
Security teams historically relied on:
- Manual baseline creation
- Complex queries
- Static thresholds
This approach is:
- Time-consuming
- Error-prone
- Difficult to scale
The UEBA Advantage
UEBA shifts the paradigm by precomputing behavioral signals:
- Readability: Complex logic can be expressed in just a few lines
- Contextual Awareness: Combines user-level and tenant-level behaviors
- Automation: Baselines and thresholds are dynamically maintained
Instead of building detection logic from scratch, analysts can now stack binary features like:
- First-time login from a country
- Uncommon ISP usage
- Rare API activity
This dramatically improves detection quality and reduces noise.
Real-World Attack Scenarios
UEBA shines when analyzing real attack patterns across the kill chain. Common scenarios include:
| Scenario | The attack | Common log view | UEBA signals (binary features) | Built-in anomaly surfaced |
| Initial Access (Federated / SAML Session Hijack) | An attacker gains access to a federated identity session – for example, through a compromised identity provider (IdP) – and uses a SAML or EXTERNAL_IDP flow to perform actions the user rarely performs, from a new location and at an unusual pace. | CloudTrail shows federated authentication activity (UserAuthentication / EXTERNAL_IDP, for example, Okta) followed by successful API calls under an assumed role session; each event is valid in isolation. | FirstTimeUserConnectedFromCountry = True ISPUncommonlyUsedInTenant = True ActionUncommonlyPerformedByUser = True ActionUncommonlyPerformedInTenant = True | UEBA Anomalous Federated or SAML Identity Activity in AwsCloudTrail |
| Initial Access and Persistence | An attacker compromises a developer’s access keys and logs in (for example, through uncommon user agent) to create a backdoor user. | CloudTrail shows a successful ConsoleLogin via SDK or CLI user agent and subsequent IAM action, such as CreateUser, all of which are valid API calls without behavioral context. | FirstTimeUserConnectedFromCountry = True BrowserUncommonlyUsedInTenant = True ActionUncommonlyPerformedByUser = True (CreateUser) ActionUncommonlyPerformedInTenant = True | Examples: UEBA Anomalous Logon in AwsCloudTrail; UEBA Anomalous IAM Privilege Modification in AwsCloudTrail |
| Credential Access & Collection (Secrets / KMS Key Discovery) | After establishing a foothold with valid credentials, an attacker queries Secrets Manager and KMS to list keys and retrieve secret values, often starting with discovery (ListSecrets/ListKeys) then access (GetSecretValue), sometimes at unusually high frequency. | CloudTrail shows a GetSecretValue, ListSecrets, or ListKeys activity which can look like legitimate automation and make static allowlists and thresholds brittle. | FirstTimeUserPerformedAction = True ActionUncommonlyPerformedInTenant = True UncommonHighVolumeOfOperations = True ISPUncommonlyUsedInTenant = True | UEBA Anomalous Secret or KMS Key Access in AwsCloudTrail |
| Data Exfiltration (the “low-and-slow” S3 drain) | A compromised admin account performs a burst of repeated S3 GetObject operations—representing a high volume of similar operations within the same service—often targeting multiple objects or prefixes in quick succession to stage data for exfiltration while staying below traditional volume thresholds. | If S3 data events are enabled, CloudTrail shows a high frequency of GetObject API calls across multiple objects or buckets in a short time window. Each request appears legitimate in isolation, and overall data transfer may remain below static thresholds, making the activity difficult to detect using traditional methods. | UncommonHighVolumeOfOperations = True CountryUncommonlyPerformedInTenant = True ActionUncommonlyPerformedByUser = True (S3 GetObject) ISPUncommonlyUsedInTenant = True | UEBA Anomalous Data Transfer from Amazon S3 |
Practical Implementation Guide
Prerequisites
Before leveraging UEBA effectively:
- Allow 7–14 days for baseline establishment
- Ensure CloudTrail integration with Sentinel
- Verify consistent log ingestion
Hunting Strategy
When querying BehaviorAnalytics:
- Look for combinations of binary features, not single indicators
- Focus on user-specific deviations
- Identify low-volume but persistent activity
These patterns often reveal stealthy attacks that traditional methods miss.
Managing False Positives
Even advanced systems generate false positives. Common scenarios include:
Automation and CI/CD
- Rare but legitimate actions from service accounts
New Admin Activity
- First-time actions triggering behavioral flags
Operational Changes
- Temporary spikes during migrations or maintenance
Instead of blanket suppression, apply targeted filtering and contextual validation.
Limitations to Consider
While powerful, UEBA is not without constraints:
- Selective Coverage: Not all AWS APIs are modeled
- Variable Enrichments: Not all events include full context
- Cross-Cloud Isolation: Baselines are calculated per platform
- UI Constraints: Some anomalies only visible for UPN-based identities
These limitations highlight the importance of combining UEBA with broader security strategies.
From Logs to Intelligence
CloudTrail provides visibility—but UEBA provides meaning.
A single failed login may seem insignificant. However, when combined with:
- First-time geography
- Unusual ISP
- Rare account usage
…it becomes a high-confidence signal of potential compromise.
UEBA enables:
- Efficiency: Simpler queries, less maintenance
- Accuracy: Reduced false positives
- Visibility: Detection of low-and-slow attacks
Our Perspective on This Approach
UEBA in Microsoft Sentinel represents a significant evolution in cloud security analytics. Instead of forcing security teams to continuously refine detection logic, it shifts the burden to machine learning models that adapt over time. This is not just a technical improvement—it’s an operational breakthrough. However, organizations should avoid over-reliance on anomaly scores alone. While UEBA simplifies detection, security still requires human judgment, contextual awareness, and environment-specific tuning. Blindly trusting automated scores can lead to missed threats or unnecessary escalations.
Another critical consideration is data quality. UEBA is only as effective as the telemetry it receives. Inconsistent CloudTrail ingestion or missing identity context can weaken enrichment accuracy and reduce detection reliability. From a strategic standpoint, UEBA works best when integrated into a layered security approach—combining behavioral analytics with traditional detection rules, threat intelligence, and incident response playbooks. Ultimately, the biggest value of UEBA is not just detection—it’s investigation acceleration. By explaining why something is suspicious, it empowers analysts to act faster and with greater confidence. Organizations that leverage this capability effectively will gain a strong advantage in defending complex cloud environments.
