Microsoft adds behavioural context to AWS security logs

Microsoft described expanded AWS behavioural analytics in Sentinel on 28 April. CloudTrail events gain contextual signals such as an unfamiliar location, unusual provider or abnormal activity volume. The account also covers identities beyond individual users, including service principals and other non-human accounts.

The proposed workflow combines those signals instead of requiring every detection author to build a separate historical baseline. A first-seen location can be relevant without being malicious; a familiar location can still carry stolen credentials. The value of the added context depends on the logs an organisation supplies and how investigators test an alert against the surrounding activity. Microsoft’s report describes its product capabilities and examples rather than an independently measured detection rate.