Creating analytics rules and handling incidents
Now that the data sources are being collected in Sentinel, we need to define some logic to look after abnormal patterns that, if found, will generate an incident.
In Microsoft Sentinel, incidents are created based on analytics rules. These rules can be divided into three different types:
- Scheduled query rules
- Microsoft incident creation rules (Security Graph API)
- Anomaly rules
If we create a scheduled query rule, we need to define a Kusto query that will run on a predefined schedule. Also, within the query, we must define a threshold if there is a match with the Kusto query; if the threshold is met, it will generate an incident.
We also have Microsoft incident creation rules, which are alerts that come from other Microsoft security products through the Security Graph API. These can be alerts from Azure AD Identity Protection, Microsoft Defender for Cloud, Microsoft Defender for Endpoint, Defender for Identity...
