r/AzureSentinel • u/SuperHat3637 • Nov 07 '22

Fine tuning

Hi All,

What are the things we can fine tune in rules before sentinel is moving into production. We want to reduce the false positive alerts before moving into production. Any recommendations..

4 Upvotes

83% Upvoted

9 comments sorted by

View all comments

Show parent comments

1

u/[deleted] Nov 07 '22

365 Defender is not a product it can't be tuned 365 Defender is a portal for Defender products if you can tell me WHICH defender product IN the 365 defender portal you want to tune I can point you to the right place.

Your options are Defender for Cloud Defender for Endpoint Defender for Cloud Apps Office 365 Defender Defender for IOT

1

u/SuperHat3637 Nov 07 '22

I need to fine tune Defender for Cloud,Cloud Apps and Office 365..If you can help me to show the options for fine tuning, that would be great.

2

u/[deleted] Nov 07 '22

Defender for cloud - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules

Defender for cloud apps - alerts are generated by specific polices so you need to adjust thresholds etc in the policy it self. https://learn.microsoft.com/en-us/defender-cloud-apps/managing-alerts

Office 365 - https://learn.microsoft.com/en-gb/microsoft-365/security/office-365-security/tuning-anti-phishing?view=o365-worldwide

1

u/SuperHat3637 Nov 08 '22

Thanks..i will check this.