UEBA - A KEY DETECTION INGREDIENT

Summary from the TLDR InfoSec newsletter

User and Entity Behavior Analytics (UEBA) can be leveraged to incorporate additional context in detections to reduce false positives. This post enhances a YARA-L rule by adding login counts and countries from the last 30 days to detect Azure command interpreter logins after multiple failures. Other example alerts that can be enriched with UEBA are also provided.