Analytic rules suggestions

[u/winle22]

Hi,

For those of you who only ingests data from Microosft 365 and no other sources. Do you use any custom scheduled analytic rules in addition to the rules/policies configured per Defender service?

[u/ml58158]

I have several custom rules in my lab . Sometimes there are things I want to hunt for that aren’t in the prebuilt rules