Microsoft Defender for Cloud Apps: Behaviors

Microsoft 365 Defender Advanced Hunting has introduced a new data type called "Behaviors". This addition will enable the security teams to prioritize critical security alerts in their environment without compromising important contextual information provided in the behavior that may be crucial for an investigation. Behaviors will provide a descriptive summary of what took place in a format helpful for identifying and measuring attacks, and attached to the MITRE tactics and techniques that are commonly used to test coverage against most organizations’ security measures. With Behaviors, anomalies will only be correlated when they are relevant, and the context of related incidents will be enriched. Some detections in Defender for Cloud Apps have already been transformed to the new Behaviors data type and can be accessed through advanced hunting. This new feature will optimize the alerts queue and enable security teams to focus on the most relevant alerts in their environment. The release date for Behaviors is August CY2023 with preview date set for March CY2023.

The post Microsoft Defender for Cloud Apps: Behaviors originally appeared on M365 Admin.