How to change a built-in response rule and read its activity

How to do it

1. 1

   Open CyberSentry, then Response Rules.

   The list shows the Source menu at the top right of the Response Rules card, beside New Rule. It starts on All sources. Pick a source to list only the rules that watch that kind of signal. One example is Identity (M365). Today that is the only source. The list looks the same either way.

2. 2

   Open a rule with the Built-in badge.

   The badge sits beside the name. Its name, steps, window and scope are read only. You can choose Disabled, Monitor or Live, and pick which actions it runs.

3. 3

   Reset it if you want the shipped setup.

   Press Reset to default and confirm. The Disabled, Monitor or Live choice and the actions go back the way they shipped. What the rule detects does not change.

4. 4

   Read what each line says.

   Each line is one match of the rule. Would run means Monitor only noted what it would do. Executed means Live ran the actions. Blocked means a safety check stopped it. The words in brackets name the check, such as Event too old. Handled in Automations means the rule runs in the new engine now. If you can open Automations, click the badge. It shows what was done in History.

5. 5

   Learn what the Session reused rule does.

   It watches one sign-in session. The session shows up on one network. Then it is used on another network within an hour. No new sign-in came between. The alert scores higher if the same person does one of these within a day. They add an MFA method, change an email rule or grant an app permission. Or they change the password. It ships turned on in Monitor, with the Notify and Open ticket actions. Switch it to Live to send the notice and open the ticket. Lock account and Revoke sessions are off until you add them. Even then they wait for a new sign-in from the suspect network. This rule does not use AI.

6. 6

   Know what keeps the rule quiet.

   It stays quiet when the second use comes from a managed device. It is quiet for a device joined to the client's directory too. It stays quiet for the same device that signed in first. It stays quiet for a network that person used before. It also stays quiet for a phone network. It stays quiet for an address that belongs to your team or the client. It stays quiet when a laptop moves to a new network and never goes back.

What you will have

• Spot a built-in rule and see what you can change on it.
• Filter the rules list by source.
• Reset a built-in rule to the way it shipped.
• Read what each Recent activity line means.
• Know what the Session reused rule does.

Why it works this way: How to change a built-in response rule and read its activity

If it did not work: How to change a built-in response rule and read its activity

• You cannot change a rule: you may have view access only. You need edit access.
• You cannot delete a built-in rule. Set it to Disabled instead.
• Rules that read sign-in logs find nothing: the client may lack Microsoft Entra ID P1. Without it, the free tier still checks role grants, app consents and MFA changes. The client's Security tab shows its tier.

Questions this page answers

Keep digging

• How a client's security settings work in CyberSentry
• What the CyberSentry Overview shows, and where each page takes you
• How Response Rules and the Confidence Engine work
• How to run security awareness training for each client