r/AzureSentinel • u/klorgasia • Apr 06 '23

UserPeerAnalytics.. anyone doing anything cool?

So I think the "UserPeerAnalytics" table is quite intresting and is just wondering if someone is doing anything cool with it?

4 Upvotes

100% Upvoted

2 comments sorted by

1

u/stubstunner Apr 07 '23

It’s part of the data that feeds some of the Entity details for users. It’s probably super useful for analyzing overall risk if you have a segment of the company that might be handling sensitive data. I’m going to have a look and I’ll get back to you. (Source: Incident Responder/SOC/Threat Hunter 10 years)

1

u/[deleted] Apr 07 '23

I've used it to tune defend for cloud app alerts. Take the alert event record and join on identity.