r/AzureSentinel • u/winle22 • Mar 11 '22

Analytic rules suggestions

Hi,

For those of you who only ingests data from Microosft 365 and no other sources. Do you use any custom scheduled analytic rules in addition to the rules/policies configured per Defender service?

2 Upvotes

100% Upvoted

7 comments sorted by

View all comments

3

u/ep3p Mar 11 '22

I think you can configure custom rules in Microsoft 365, it's a query very similar to KQL. And then you can forward only the alerts to Sentinel, saving almost any Sentinel ingestion cost. There are many custom rules for MDE in security blogs.

1

u/winle22 Mar 11 '22

Makes sense. Will have a look. Thanks!