To avoid detections, sophisticated attackers will most likely use a method where they try to go under the radar and masquerade their actions as normal activities. In the scale between ordinary, innoc...
Updated Jul 27, 2022
Version 1.0
Blog Post
Idan_Bellayev When the anomaly rules were previously not in the anomaly tab they could freely be deleted from the analytic rule tab. In one of our Sentinel workspaces we are completely missing any rules in the anomaly tab from what I assume was a previous deletion of these rules when they were in the analytic rule tab.
Is there a way to re-add the anomaly rules without making a whole new workspace? The anomaly rules are not in the templates section anymore, nor can they be added from ARM templates that we had previously downloaded.
Thank you.