Detection rules

Enable, test, and author content that feeds the alert queue. Run detections against live OpenSearch Windows events (4625).