Feb 02 2022 08:39 AM
Hi,
I am trying to build a rule to detect ransomware. I was following the rule "Advanced multistage attack detection" but most of the log sources it has coming from Microsoft products look like although it does have something called "Raw logs from other sources" so does it mean that it will analyze all other data that is coming in my environment? We will be doing a ransomware simulation so I want to create a rule to observe on Sentinel so when the simulation starts, I can track unusual activity.
Any suggestion would be appreciated.
Feb 03 2022 07:33 AM
Feb 08 2022 12:01 PM