Introduction
This article will provide information to help you identify a record of an unusual event when analyzing logs.
Behavior
Columns such as Behavior.SourceIP or Behavior.SourceUserName are added by alert rules. When an enabled alert rule has a behavior condition on a column (for example Source.IP or Source.UserName) and the value in the event is found in one of the lists selected in that condition, the name of the list is written to the matching Behavior column. The values in Behavior.SourceIP or other Behavior columns therefore tell you which lists the value is present in.
Behavior columns are written while alert rules are evaluated, after the event has already been sent for indexing. You will see them on the alert records produced by those rules, not on the raw logs in Search. Lists can still enrich the logs themselves through their update fields. For example, the built-in Administrators list adds its name to Source.UserGroup for users in the list.
In the log example below, we can say that the IP address 192.168.250.184 is in the list of sources accessing a malicious IP address by looking at the Behavior.SourceIP column.
In the example log below, we can say that the user with Source.UserName:adminlgs is also in the Administrators list.
You can review the lists under Settings > Alerts & Incidents > Buckets. When we examine the Administrators list there, we can see that it is a list of type Static that includes users with admin privileges.