17 Oct 2026 9 min read
Sentinel analytics rules to enable first
How to pick Sentinel analytics rules to enable first: content hub templates, data source checks, false-positive tuning and the Defender portal.
Sentinel SIEM Detection
Focus area
Defender
Deep dives covering Defender.
Guides, runbooks, and opinions focused on Defender.
Featured runbook
Sentinel Defender portal move: runbook and checks
Learn gives 31 March 2027 for the Sentinel Defender portal move. What changes for roles, automation and workspaces, and a runbook to onboard safely.
Read now
Need context?
Jump into the guided path, or browse everything if you’re after something specific.
Explore other focus areas
Hop between landing zones, identity, networking, and more.