All About Microsoft Sentinel UEBA

Attackers frequently try to display their actions as normal activities and in the balance between ordinary user activity and obvious attacker doings - there is a grey area. This grey area may pose imminent threats to your organization but could be overlooked. Learn how UEBA builds comprehensive profiles of the user and entity across time and peer group horizons to best find anomalies and suspicious activity.
00:12:26 Demo

[@1213xyz]

Does UEBA costs extra? IF so how much or how to calculate?

[@theacademyhub]

No special license is required to add UEBA to Microsoft Sentinel, and there's no additional cost for using it. However, the more data you ingest, and the longer you choose to retain it, will lead to higher costs.

[@1213xyz]

Thank you. My understanding is UEBA will create new table/s hence new data or extra data, which would lead to extra costs. Is this right? @@theacademyhub

[@theacademyhub]

UEBA generates new data and stores it in new tables that UEBA creates in your Log Analytics workspace (LAW). Additional data storage charges will apply, based on the volume of data ingested and retained by UEBA and similar to other Microsoft Sentinel capabilities. So yes, it would lead to extra costs.