A security analyst is using Microsoft Sentinel's User and Entity Behavior Analytics (UEBA) to investigate an Azure AI service account that has been flagged as having anomalous activity. The UEBA engine has raised an 'Anomalous Azure resource access' insight for this service principal. Where in Sentinel can the analyst see the full UEBA profile for this entity including timeline, peer comparison, and risk score?

The correct place is the Microsoft Sentinel > Entity behavior > Entity page for the specific service principal. Microsoft Sentinel's UEBA engine populates entity pages for users, devices, and service principals. The entity behavior page for the service principal shows the UEBA risk score, a timeline of activities, anomalous insights detected by the ML engine (like the anomalous Azure resource access), peer comparison data showing how this entity's behavior differs from similar service principals, and a list of related incidents. This provides the analyst with a holistic view of the entity's behavioral risk. The Microsoft Sentinel > Logs > KQL query against the BehaviorAnalytics table is wrong because while the BehaviorAnalytics table in KQL contains the raw UEBA data, querying it directly does not provide the visual entity page with timeline and peer comparison that the question asks about. The Microsoft Entra ID > Identity Protection > Risky workload identities page is wrong because it shows identity risk detections for service principals based on Entra-specific signals, not the full Sentinel UEBA profile with Azure resource activity. The Microsoft Defender XDR > Incidents > Entity timeline view is wrong because Defender XDR entity timeline shows endpoint and identity-related activities within Defender's scope, not the full Sentinel UEBA profile.