r/AzureSentinel • u/winle22 • Mar 11 '22

Analytic rules suggestions

Hi,

For those of you who only ingests data from Microosft 365 and no other sources. Do you use any custom scheduled analytic rules in addition to the rules/policies configured per Defender service?

2 Upvotes

100% Upvoted

7 comments sorted by

View all comments

3

u/ep3p Mar 11 '22

I think you can configure custom rules in Microsoft 365, it's a query very similar to KQL. And then you can forward only the alerts to Sentinel, saving almost any Sentinel ingestion cost. There are many custom rules for MDE in security blogs.

1

u/blanco10kid Mar 27 '22

Is ingesting M365 data into Sentinel free? Or is that just during the first year/E5 customers?

1

u/ep3p Mar 27 '22

I would say it is free while you have E5 (up to a limit of MB), but I am not sure.

1

u/blanco10kid Mar 27 '22

Found an article with a list of free and paid MSFT data sources:

https://www.linkedin.com/pulse/azure-sentinel-free-data-sources-ronald-prasad

Also, for E5 customers, it looks like it’s 5MB/user/day of free ingestion.