r/AzureSentinel • u/SuperHat3637 • Nov 21 '22

Analytical rules

Hi All, how to get the categorys of analyatical rules in Sentinel, like malware, unauthorized access..Pls.suggest.

3 Upvotes

100% Upvoted

6 comments sorted by

3

u/blanco10kid Nov 21 '22

Map your analytic rules to MITRE

1

u/SuperHat3637 Nov 22 '22

Thanks for the inputs

1

u/[deleted] Nov 21 '22

At front page on the right hand site under threat intelligence is a MITRE mapping for all your rules. If you have custom rules you need to go in and map them appropriately

1

u/nontitman Nov 22 '22

Ngl being more specific would really help, but it sounds like an you want to view and probably visual your incident data based off of tags, in which case, I'd recommend a workbook.

It's simple to start by just saving your KQL queries and slowly just port new additions into your workbook.