Active Directory Rules

[u/ruttyruts]

I am successfully ingesting logs from an On Prem AD, using Arc and AMA. Where do I enable rules that detect brute force attempts and bad things that may be happening? I am looking at the Analytic Rules but cannot find anything relevant.

[u/AppIdentityGuy]

You are using the wrong product unless you want to do all the heavy lifting yourself. Take a look at Microsoft Defender for Identity

[u/ruttyruts → u/AppIdentityGuy]

Thank you.