Chapter 7: Creating Analytic Rules

Now that you have connected your data to Azure Sentinel and know how to write your own KQL queries, you need to know how to use those queries to detect suspicious events. This is where Azure Sentinel Analytics comes into play.

Analytics is the heart of Azure Sentinel. This is where you will set up analytic rules and queries that can run automatically to detect issues that you may have. These rules can run queries that you build on your own or they can come from the ever-growing list of templates that Microsoft provides. This is exactly what we will learn to do in this chapter.

This chapter will take you through the following topics:

• An introduction to analytic rules
• The various types of analytic rules
• Creating rules from templates
• Creating new rules and queries using the wizard
• Managing rules, including editing and deleting