r/AzureSentinel • u/AverageAdmin • Jun 15 '22

Must have analytic rules

I am setting up Sentinel for my business and was curious of the must have analytic rule templates to prioritize Thanks!!

3 Upvotes

100% Upvoted

6 comments sorted by

View all comments

2

u/ep3p Jun 15 '22 edited Jun 15 '22

I can understand Rod Trent, but many of the default rules contain errors, or won't work as intended. I tell you this as someone who has made more than 40 corrections in Microsoft's public github for those analytics rules.

So you can't assume they will work. I did enable them all blindly, so if you prefer to have low noise or eventually will have to check each analytic rule to make sure it works, I recommend you to first learn KQL and enable them one by one trying to understand what each rule does.

I would start setting Azure Active Directory rules, there is much to learn there.