Your SOC Has a Secret Weapon. Almost Nobody Uses It.

**Executive summary:** This document is a practical guide to using UEBA and the Behaviors Layer in Microsoft Sentinel to accelerate investigations and improve detections — it covers combining InvestigationPriority and AnomalyScore, peer comparisons, identity enrichment, assessing blast radius, reconstructing attack chains, reducing alert noise, and includes numerous KQL examples and table mappings.