Explanation:

When User and Entity Behavior Analytics (UEBA) is enabled in Microsoft Sentinel, it creates several dedicated tables within the Log Analytics workspace to store processed data for behavioral analytics and anomaly detection. Each table serves a specific purpose according to Microsoft documentation.
* BehaviorAnalytics Table - for viewing entity dataThe BehaviorAnalytics table stores enriched information about entities (such as users, hosts, IP addresses, and applications) and their observed behaviors. Each record includes multiple fields that describe user or entity activities, risk scores, and behavioral baselines. Microsoft Sentinel documentation states:
"Use the BehaviorAnalytics table to view the entity data collected and analyzed by UEBA. This table contains fields for each type of entity, including account, host, and IP data." Therefore, to view the entity data with detailed attributes for each type, you query the BehaviorAnalytics table in KQL.
* Anomalies Table - for assessing rule qualityThe Anomalies table is used to analyze the results of anomaly detection rules and evaluate their effectiveness. Each record represents an anomaly event generated by UEBA's machine learning or statistical models. Microsoft's UEBA and Sentinel analytics documentation explains:
"Use the Anomalies table to assess the performance and quality of your anomaly detection rules. The table helps you identify how well each rule detects unusual activities and whether it produces false positives." Thus, when you need to measure how well your rules perform (i.e., their quality, hit rate, or alert effectiveness), you use the Anomalies table.
Summary Mapping:
* View entity data # BehaviorAnalytics
* Assess rule quality # Anomalies
This mapping aligns directly with the functionality of UEBA-related tables in Microsoft Sentinel and follows official documentation for analyzing entity behaviors and anomaly rule performance.