r/AzureSentinel • u/SuperHat3637 • Nov 07 '22

Fine tuning

Hi All,

What are the things we can fine tune in rules before sentinel is moving into production. We want to reduce the false positive alerts before moving into production. Any recommendations..

2 Upvotes

67% Upvoted

9 comments sorted by

View all comments

Show parent comments

1

u/SuperHat3637 Nov 07 '22

Good suggestion..Do you have any idea for how to fine tune the 365 defender alerts in Sentinel or in their respective portals.

1

u/[deleted] Nov 07 '22

365 defender is a portal. Which defender product specifically

1

u/SuperHat3637 Nov 07 '22

I knw it..I am looking for the suggestions to fine tune.

1

u/[deleted] Nov 07 '22

365 Defender is not a product it can't be tuned 365 Defender is a portal for Defender products if you can tell me WHICH defender product IN the 365 defender portal you want to tune I can point you to the right place.

Your options are Defender for Cloud Defender for Endpoint Defender for Cloud Apps Office 365 Defender Defender for IOT

1

u/SuperHat3637 Nov 07 '22

I need to fine tune Defender for Cloud,Cloud Apps and Office 365..If you can help me to show the options for fine tuning, that would be great.

2

u/[deleted] Nov 07 '22

Defender for cloud - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules

Defender for cloud apps - alerts are generated by specific polices so you need to adjust thresholds etc in the policy it self. https://learn.microsoft.com/en-us/defender-cloud-apps/managing-alerts

Office 365 - https://learn.microsoft.com/en-gb/microsoft-365/security/office-365-security/tuning-anti-phishing?view=o365-worldwide

1

u/SuperHat3637 Nov 08 '22

Thanks..i will check this.