Best practice Custom Detection Rules

Hi,

I have a Defender ATP environment with several thousand clients in it and I have been asked to automate whatever I can for compliance and remediation.

Can anyone recommend some best practice custom detection rules you might use with Defender ATP to help build foundations on automation?

Regards

Mike