Tweak

Author: yelevin

articles/sentinel/common-threat-detection-scenarios.md

@@ -1332,6 +1332,8 @@ For more information, see [Insecure protocols workbook setup](./get-visibility.m
 
 See also: [**Windows Security Events**](#windows-security-events-preview) connector based on Azure Monitor Agent (AMA)
 
+[Configure the **Security events / Windows Security Events connector** for **anomalous RDP login detection**](#configure-the-security-events--windows-security-events-connector-for-anomalous-rdp-login-detection).
+
 ## SentinelOne (Preview)
 
 | Connector attribute | Description |
@@ -1593,7 +1595,32 @@ We recommend installing the [Azure Sentinel Information Model (ASIM)](normalizat
 | **Supported by** | Microsoft |
 | | |
 
-Use the Windows Security Events connector, or the legacy [**Security events**](#security-events-windows) connector, to [detect anomalous RDP logins](common-threat-detection-scenarios.md#configure-the-security-events--windows-security-events-connector-for-anomalous-rdp-login-detection).
+
+See also: Legacy [**Security events**](#security-events-windows) connector.
+
+### Configure the Security events / Windows Security Events connector for anomalous RDP login detection
+
+> [!IMPORTANT]
+> Anomalous RDP login detection is currently in public preview.
+> This feature is provided without a service level agreement, and it's not recommended for production workloads.
+> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
+
+Azure Sentinel can apply machine learning (ML) to Security events data to identify anomalous Remote Desktop Protocol (RDP) login activity. Scenarios include:
+
+- **Unusual IP** - the IP address has rarely or never been observed in the last 30 days
+
+- **Unusual geo-location** - the IP address, city, country, and ASN have rarely or never been observed in the last 30 days
+
+- **New user** - a new user logs in from an IP address and geo-location, both or either of which were not expected to be seen based on data from the 30 days prior.
+
+**Configuration instructions**
+
+1. You must be collecting RDP login data (Event ID 4624) through the **Security events** or **Windows Security Events** data connectors. Make sure you have selected an [event set](windows-security-event-id-reference.md) besides "None", or created a data collection rule that includes this event ID, to stream into Azure Sentinel.
+
+1. From the Azure Sentinel portal, select **Analytics**, and then select the **Rule templates** tab. Choose the **(Preview) Anomalous RDP Login Detection** rule, and move the **Status** slider to **Enabled**.
+
+    > [!NOTE]
+    > As the machine learning algorithm requires 30 days' worth of data to build a baseline profile of user behavior, you must allow 30 days of Windows Security events data to be collected before any incidents can be detected.
 
 ## Workplace from Facebook (Preview)