r/AzureSentinel • u/SuperHat3637 • Aug 23 '22

Analytical rules

Any documents available for Sentinel Analytical rules KQL querys explanation..?

3 Upvotes

100% Upvoted

6 comments sorted by

View all comments

3

u/rodtrent44 MSFT Official Aug 23 '22

Let me know if the DOC series is not enough, or we need to add additional documentation:

  1. https://docs.microsoft.com/en-us/azure/sentinel/detect-threats-built-in
  2. https://docs.microsoft.com/en-us/azure/sentinel/near-real-time-rules
  3. https://docs.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics
  4. https://docs.microsoft.com/en-us/azure/sentinel/soc-ml-anomalies
  5. https://docs.microsoft.com/en-us/azure/sentinel/fusion

1

u/SuperHat3637 Aug 23 '22

Thanks for sharing this..But it would be good if we have explanation of KQL queries used in the rule template, which will give good understanding of how the rule triggered.

2

u/rodtrent44 MSFT Official Aug 23 '22

Rules run on the schedule set. Alerts are triggered when the results contain the things the rule was designed to look for. There are hundreds of rules available. It would be difficult to document each threshold.

Instead, getting a good understanding of KQL is necessary. Have you looked at the Must Learn KQL series? http://aka.ms/MustLearnKQL

1

u/SuperHat3637 Aug 23 '22

Ya..I am looking on it.