What do you need to do after you create an active rule that has the default settings?

Written by John Gruber Published on Last Updated on

You have previously setup Microsoft Sentinel workspace for your organization. You've created and configured a connector to Azure AD and Microsoft Office 365.

Recently, your organization had a breach where the attacker used compromised credentials to login then deleted multiple files from Microsoft OneDrive.

Your boss has asked you to configure Microsoft Sentinel to detect these types of attacks.

You create the active rule that has the default settings. What do you need to configure next?