Build Your Detection Package
A collection shaped around your environment. Choose the telemetry you collect, set your selection policy, and take the original Sigma rules with you.
Starting RuleSuspicious Email Delivered In Microsoft 365
Product, telemetry, and policy were prefilled from this rule. Adjust the selections to shape your package.
STEP 2 / 4
Which Telemetry Do You Collect?
Select sources that are already collected and searchable. These are your declarations; field availability and collection configuration still need verification.