Sentinel Rule Wizard-AI-enhanced Sentinel query optimization

Example

A user provides a basic query like 'DeviceProcessEvents | where InitiatingProcessFolderPath has "powershell"'. The wizard optimizes it to exclude non-malicious processes, possibly by adding conditions to check for suspicious parent processes or limiting the scope to specific time frames.

Scenario

A security analyst needs to ensure their queries in Sentinel are not generating too many false positives, which can overwhelm the team with unnecessary alerts. The wizard refines the query to make it more precise.

Example

After refining a query, the wizard might suggest a rule name such as 'Detect PowerShell Execution from Web Browsers' and a description that outlines the rule's purpose, e.g., 'This rule detects instances where PowerShell is launched by common web browsers, which may indicate an attempt to execute scripts via phishing attacks.'

Scenario

An IT manager wants to create a new rule in Sentinel but struggles to articulate the rule’s intent clearly. The wizard provides a structured name and description that align with best practices.

Example

The wizard advises on the appropriate severity level for the rule, suggests suitable response actions, and recommends which log sources to include or exclude.

Scenario

A security operations center (SOC) team needs to ensure that new rules are properly prioritized and actionable. The wizard helps configure the rule to ensure it triggers the correct responses and is appropriately integrated into existing workflows.