Analytics Rules
Sentinel analytics (detection) rules visible through the API.
| Rule | Name | Severity | Enabled | Query |
|---|---|---|---|---|
| rule-002 | LSASS access anomalies | High | Enabled | DeviceProcessEvents | where ProcessCommandLine has 'lsass' |
| rule-003 | Ransomware file extensions | Critical | Enabled | DeviceFileEvents | where FileName endswith '.lockbit' |
| rule-004 | SMB lateral movement | Medium | Enabled | DeviceNetworkEvents | where RemotePort == 445 |
| rule-001 | Suspicious PowerShell (encoded) | High | Enabled | DeviceProcessEvents | where ProcessCommandLine contains '-enc' |
