Skip to main content

A New Qiita Article: Sentinel User Behavior Analytics with ASIM Authentication

· One min read
James Yip
James Yip

Eventus published a Qiita article, “Designing Sentinel User Behavior Analytics Without Raw-Table Dependencies: Using ASIM Authentication as the User Baseline”. It looks at why analytics built directly on SigninLogs, SecurityEvent, and connector-specific logs become harder to maintain as authentication sources multiply. High raw-event volumes can also hit query result limits, while connector or ingestion gaps can leave missing data.

Using normalized imAuthentication events provides a common basis for authentication analytics. Aggregating early by user keeps query results manageable and makes the analytics reusable across hybrid environments.

Read the article​

If you design user behavior analytics or Microsoft Sentinel detections, read the Sentinel and ASIM article on Qiita.

Contact Eventus to discuss Sentinel and SIEM+ operations.