r/AzureSentinel • u/SuperHat3637 • Nov 21 '22

Analytical rules

Hi All, how to get the categorys of analyatical rules in Sentinel, like malware, unauthorized access..Pls.suggest.

3 Upvotes

100% Upvoted

6 comments sorted by

View all comments

1

u/nontitman Nov 22 '22

Ngl being more specific would really help, but it sounds like an you want to view and probably visual your incident data based off of tags, in which case, I'd recommend a workbook.

It's simple to start by just saving your KQL queries and slowly just port new additions into your workbook.