Over 50 key behaviours measured out of the box.

SebDB

To begin it's best to brush up on which security behaviours are most important to your organisation. Head over to SebDB, the world’s cyber security behaviour database.

Security behaviours

Below is a list of all of our security behaviours you can track with each integration.

Security behaviour	Data source
`SB163` Opens only a legitimate message	Abnormal Security
`SB087` Reports a suspicious message	Cofense Triage
`SB024` Keeps software up-to-date	Crowdstrike
`SB213` Uses a device that has not been compromised	Crowdstrike
`SB005` Authenticates with SSO	Google Workspace
`SB018` Uses only an approved or official browser extension	Google Workspace
`SB087` Reports a suspicious message	Google Workspace
`SB105` Authenticates with a security key	Google Workspace
`SB112` Authenticates with a passkey	Google Workspace
`SB213` Uses a device that has not been compromised	Google Workspace
`SB171` Uses a work email address that has not been compromised	Have i been pwned?
`SB013` Reports a security incident	Incident.io Coming Soon
`SB024` Keeps software up-to-date	Iru
`SB159` Clicks only a legitimate link	KnowBe4 PhishER Coming Soon
`SB164` Opens an attachment only in a legitimate message	KnowBe4 PhishER Coming Soon
`SB024` Keeps software up-to-date	Lookout Coming Soon
`SB036` Secures a device when not in use	Lookout Coming Soon
`SB154` Visits only an approved or official website	Lookout Coming Soon
`SB159` Clicks only a legitimate link	Lookout Coming Soon
`SB189` Uses an approved application on a work device	Lookout Coming Soon
`SB203` Authenticates with biometrics	Lookout Coming Soon
`SB213` Uses a device that has not been compromised	Lookout Coming Soon
`SB001` Authenticates with MFA	Microsoft 365
`SB005` Authenticates with SSO	Microsoft 365
`SB087` Reports a suspicious message	Microsoft 365
`SB094` Works only on an approved device	Microsoft 365
`SB105` Authenticates with a security key	Microsoft 365
`SB112` Authenticates with a passkey	Microsoft 365
`SB189` Uses an approved application on a work device	Microsoft 365
`SB203` Authenticates with biometrics	Microsoft 365
`SB019` Downloads content only from an approved or official website	Microsoft Defender*
`SB022` Uses antivirus on a device	Microsoft Defender*
`SB032` Inserts only an approved removable media into a device	Microsoft Defender*
`SB083` Checks a message for malicious content before sharing	Microsoft Defender*
`SB131` Uses elevated privileges only when approved	Microsoft Defender*
`SB154` Visits only an approved or official website	Microsoft Defender*
`SB159` Clicks only a legitimate link	Microsoft Defender*
`SB213` Uses a device that has not been compromised	Microsoft Defender*
`SB022` Uses antivirus on a device	Microsoft Intune
`SB024` Keeps software up-to-date	Microsoft Intune
`SB044` Enables full-disk or device encryption	Microsoft Intune
`SB094` Works only on an approved device	Microsoft Intune
`SB150` Uses a password (or passphrase) that has not been compromised	Microsoft Entra ID Protection
`SB010` Keeps a password (or passphrase) private	Microsoft Purview DLP
`SB091` Shares sensitive information only with an approved recipient	Microsoft Purview DLP
`SB185` shares sensitive information only in an approved communication channel	Microsoft Purview DLP
`SB159` Clicks only a legitimate link	Mimecast
`SB083` Checks a message for malicious content before sharing	Proofpoint
`SB159` Clicks only a legitimate link	Proofpoint
`SB015` Completes security awareness training	SAP Success Factors
`SB010` Keeps a password (or passphrase) private	Slack
`SB083` Checks a message for malicious content before sharing	Slack
`SB185` shares sensitive information only in an approved communication channel	Slack
`SB001` Authenticated with MFA	Splunk Coming Soon
`SB003` Authenticates with a strong password (or passphrase)	Splunk Coming Soon
`SB009` Deactivates or deletes unneeded account	Splunk Coming Soon
`SB010` Keeps a password (or passphrase) private	Splunk Coming Soon
`SB013` Reports a security incident	Splunk Coming Soon
`SB014` Asks for security-related help	Splunk Coming Soon
`SB019` Downloads content only from an approved or official website	Splunk Coming Soon
`SB023` Uses a firewall on a device	Splunk Coming Soon
`SB024` Keeps software up-to-date	Splunk Coming Soon
`SB055` Reads and agrees to organisational security policies	Splunk Coming Soon
`SB083` Checks a message for malicious content before sharing	Splunk Coming Soon
`SB087` Reports a suspicious message	Splunk Coming Soon
`SB091` Shares sensitive information only with an approved recipient	Splunk Coming Soon
`SB094` Works only on an approved device	Splunk Coming Soon
`SB150` Uses a password (or passphrase) that has not been compromised	Splunk Coming Soon
`SB152` Authenticates with shared login details only when approved	Splunk Coming Soon
`SB154` Visits only an approved or official website	Splunk Coming Soon
`SB156` Shares sensitive information only on an approved or official website or application	Splunk Coming Soon
`SB159` Clicks only a legitimate link	Splunk Coming Soon
`SB163` Opens only a legitimate message	Splunk Coming Soon
`SB164` Opens an attachment only in a legitimate message	Splunk Coming Soon
`SB173` Uses a work email address only for a work purpose	Splunk Coming Soon
`SB178` Shares a device only with an approved individual	Splunk Coming Soon
`SB185` shares sensitive information only in an approved communication channel	Splunk Coming Soon
`SB203` Authenticates with biometrics	Splunk Coming Soon
`SB154` Visits only an approved or official website	Zscaler NSS Coming Soon

* Up to 30 days historical data depending on customer retention policy.

What the Microsoft behaviours need

Most Microsoft behaviours come from the connections you already have. A few need something on your tenant:

Authenticates with MFA, Authenticates with a passkey, Authenticates with a security key and Authenticates with biometrics are read from Entra's authentication methods report, once a day. They need a Microsoft Entra ID P1 or P2 licence. The MFA behaviour also records a negative when a person's default second factor is SMS or a voice call. A phone method kept only as a backup does not count.
Works only on an approved device is positive when a person signs in from a device Entra reports as compliant and managed.
Uses antivirus on a device is read from Intune once a day for Windows devices. It is positive when malware and real-time protection are on and signatures are current, and negative when signatures are overdue. Devices with protection off are not scored, because Defender in passive mode next to another antivirus looks the same.
Uses elevated privileges only when approved comes from Defender and records a negative for each interactive local admin logon, at most one per person per day. It needs Defender for Endpoint plus Defender for Identity or Microsoft Sentinel. The event is recorded against the person who logged on, not the device owner.
Purview DLP behaviours only score rules you have switched on. Rules in any test mode are ignored, and SharePoint and OneDrive matches only count when the file is viewable by people outside your organisation.

You can see which behaviours each connected source is producing under Settings > Integrations on the Security behaviours tab, and hide any you'd rather not measure in Advanced settings.

Still have any questions?

If you have any questions or concerns, you can contact the team at [email protected] and we’ll be happy to answer them.

Security behaviors tracked by CybSafe and our integrations

SebDB

Security behaviours

What the Microsoft behaviours need

Still have any questions?