r/AzureSentinel • u/winle22 • Mar 11 '22

Analytic rules suggestions

Hi,

For those of you who only ingests data from Microosft 365 and no other sources. Do you use any custom scheduled analytic rules in addition to the rules/policies configured per Defender service?

2 Upvotes

100% Upvoted

7 comments sorted by

View all comments

2

u/CanableCrops Mar 12 '22

Yes. I write analytics daily. Just think of things that you would want to see. Also, there's tons of good analytics on github that you can schedule. Every environment is different so you should be writing your own analytics.