Ongoing project: Due to its scope, this project is still being updated. Content on this page may change as work continues.
Planned Content
50 baseline detections for a regulated environment, researched against attack types common to the industry
Threat intelligence research using AlienVault, Microsoft, and industry ISAC feeds
MITRE ATT&CK mapping to track coverage
How some detections span several analytic rules, bringing the total to 90+ analytic rules
Tuning: NTLM authentication alerts from network shares are the only noisy ones, and work to eliminate NTLM is in progress
Analytic rules that alert on log-ingestion issues, which are often caused by patching
The hardest part: KQL that aggregates across tables, since every tenant exposes data differently and several rules took trial and error
Detections that have fired to date: credential-compromise events, mitigated by layered (defense-in-depth) controls
A Sentinel query library organized in a folder tree, with each saved query named after its analytic rule, used to train junior staff in a recurring knowledge-sharing meeting