
Explanation:
Box 1: SentinelBehaviorInfo
You should query the SentinelBehaviorInfo table for the primary behavior records.While Microsoft Sentinel uses tables like BehaviorInfo for its Advanced Hunting layer, Azure Monitor Workbooks require the workspace-native schema. Therefore, queries built into workbooks must rely on the SentinelBehaviorInfo table to fetch core behavioral data such as MITRE ATT&CK mappings, threat indicators, and descriptions.
Box 2: AdditionalFields
Use the AdditionalFields metadata field to reference and drill down to raw logs.In Microsoft Sentinel's UEBA behaviors layer, the AdditionalFields column in the BehaviorInfo table is specifically designed to store references and metadata to the underlying raw telemetry (such as specific record or event IDs). In contrast, Categories is used for MITRE ATT&CK and tactic mappings, and Title is reserved for the behavioral summary description.
Reference:
https://www.modernsecurity.nl/ueba-behaviors-layer-in-microsoft-sentinel/
https://learn.microsoft.com/en-us/azure/sentinel/entity-behaviors-layer