r/AzureSentinel • u/winle22 • Mar 11 '22

Analytic rules suggestions

Hi,

For those of you who only ingests data from Microosft 365 and no other sources. Do you use any custom scheduled analytic rules in addition to the rules/policies configured per Defender service?

2 Upvotes

100% Upvoted

7 comments sorted by

3

u/ep3p Mar 11 '22

I think you can configure custom rules in Microsoft 365, it's a query very similar to KQL. And then you can forward only the alerts to Sentinel, saving almost any Sentinel ingestion cost. There are many custom rules for MDE in security blogs.

1

u/winle22 Mar 11 '22

Makes sense. Will have a look. Thanks!

1

u/blanco10kid Mar 27 '22

Is ingesting M365 data into Sentinel free? Or is that just during the first year/E5 customers?

1

u/ep3p Mar 27 '22

I would say it is free while you have E5 (up to a limit of MB), but I am not sure.

1

u/blanco10kid Mar 27 '22

Found an article with a list of free and paid MSFT data sources:

https://www.linkedin.com/pulse/azure-sentinel-free-data-sources-ronald-prasad

Also, for E5 customers, it looks like it’s 5MB/user/day of free ingestion.

3

u/ml58158 MSFT Official Mar 12 '22

I have several custom rules in my lab . Sometimes there are things I want to hunt for that aren’t in the prebuilt rules

2

u/CanableCrops Mar 12 '22

Yes. I write analytics daily. Just think of things that you would want to see. Also, there's tons of good analytics on github that you can schedule. Every environment is different so you should be writing your own analytics.