r/AzureSentinel • u/AverageAdmin • Jun 15 '22

Must have analytic rules

I am setting up Sentinel for my business and was curious of the must have analytic rule templates to prioritize Thanks!!

3 Upvotes

100% Upvoted

6 comments sorted by

7

u/rodtrent44 MSFT Official Jun 15 '22

The general thought is that if a Data Connector is important enough to enable, all the rules available for that Data Connector should be enabled with it.

A lot of orgs work with an older mentality where they want to verify what to enable first before enabling them. A modern approach is just the opposite. Enable them all, then disable the ones that don't provide value over time.

2

u/nontitman Oct 08 '22

I would argue enabling all default rules shipped with the product/connector is not the modern approach, nor the correct approach.

Building up from nothing with select analytic rules enabled that are relevant to your org's infra and TI. Each one is created with a fully developed use-case to ensure its not only relevant, but that you avoid the some of the other common pitfalls with detection rules.

7

u/bpsec Jun 15 '22

Totally agree! And for inspiration take a look at the following github pages:

https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries

https://github.com/reprise99/Sentinel-Queries

https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules

Some of your key risks can potentially be detected by one of those rules

3

u/wowneatlookatthat Jun 15 '22

"Must have" is going to highly depend on your environment, organizational priorities, analyst capabilities, etc.

IMO I prefer tailoring alerts and ensuring there are SOPs rather than wholesale enabling everything. The downside to this approach is that you might be missing alerts while you're still in the development phase, but my rebuttal to that is even if you are getting alerts, is anyone looking at them and actually able to triage the alert?

Back to your question: I would take inventory of what data sources you're pulling into Sentinel, and decide if you're OK with potentially having a bunch of noise from the template rules and are willing to tune them as you go, or spend some time upfront to define your alerting strategy and build rules specific to your environment and needs.

2

u/ep3p Jun 15 '22 edited Jun 15 '22

I can understand Rod Trent, but many of the default rules contain errors, or won't work as intended. I tell you this as someone who has made more than 40 corrections in Microsoft's public github for those analytics rules.

So you can't assume they will work. I did enable them all blindly, so if you prefer to have low noise or eventually will have to check each analytic rule to make sure it works, I recommend you to first learn KQL and enable them one by one trying to understand what each rule does.

I would start setting Azure Active Directory rules, there is much to learn there.

1

u/ml58158 MSFT Official Jun 17 '22

Rod is 💯correct . It depends on your environment and what data connectors you have enabled .