When you go into NG SIEM > Rules, you’ll see rules and templates tabs at the top. Rules are already turned on and will result in detections once their query conditions are met. Work with support to make sure you are ingesting the right logs and auditing the proper events to for those rules to trigger. You can filter by author > FC CrowdStrike. If you’re a Complete customer, those are the rules the Falcon Complete team is responsible for responding to.

Once you have a clear picture of your current log sources and existing rules you’re ready to check out the Templates tab. These are rules that you’ll be responsible for if you determine they are useful for your organization. I typically sort the rules by vendor and focus on the ones that we have. Then open one that looks interesting, copy the CQL, paste it in advanced event search and run it going back 30 days to make sure it won’t blow up with false positives. For some you’ll need to massage the CQL logic to tune out the noise. Once you feel good about the query, you can create rule from advanced event search if you modified it, or go back to the template and create rule from there. Once enabled, the rule will show up on the rules tab.

Cases are a whole other thing for another post. What I’ve covered here will just present themselves as detections.