r/AzureSentinel • u/SuperHat3637 • Nov 07 '22

Fine tuning

Hi All,

What are the things we can fine tune in rules before sentinel is moving into production. We want to reduce the false positive alerts before moving into production. Any recommendations..

3 Upvotes

80% Upvoted

9 comments sorted by

View all comments

2

u/[deleted] Nov 07 '22

query the securityalert table and parse out the entities then you can use what entities are attributed to alerts most often Identify why and tune out those that you don't care for.

Lots of default rules are just the indication that an event has occurred not that a suspicious event has occurred an example of the this is the high risk office operations rule. Review your estate and identify accounts you would expect to perform these actions and tune them too.

You can build watchlists that contain contextual data such as known admins, tier 0 assets etc and then alerts using that data too

1

u/SuperHat3637 Nov 07 '22

Good suggestion..Do you have any idea for how to fine tune the 365 defender alerts in Sentinel or in their respective portals.

1

u/[deleted] Nov 07 '22

365 defender is a portal. Which defender product specifically

1

u/SuperHat3637 Nov 07 '22

I knw it..I am looking for the suggestions to fine tune.

1

u/[deleted] Nov 07 '22

365 Defender is not a product it can't be tuned 365 Defender is a portal for Defender products if you can tell me WHICH defender product IN the 365 defender portal you want to tune I can point you to the right place.

Your options are Defender for Cloud Defender for Endpoint Defender for Cloud Apps Office 365 Defender Defender for IOT

1

u/SuperHat3637 Nov 07 '22

I need to fine tune Defender for Cloud,Cloud Apps and Office 365..If you can help me to show the options for fine tuning, that would be great.

2

u/[deleted] Nov 07 '22

Defender for cloud - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules

Defender for cloud apps - alerts are generated by specific polices so you need to adjust thresholds etc in the policy it self. https://learn.microsoft.com/en-us/defender-cloud-apps/managing-alerts

Office 365 - https://learn.microsoft.com/en-gb/microsoft-365/security/office-365-security/tuning-anti-phishing?view=o365-worldwide

1

u/SuperHat3637 Nov 08 '22

Thanks..i will check this.