how you can rephrase that : recommendation about sentinel ( create automation about reccurent False positives ( connection alertss related to xbox domain, or mails reported related to trusted domains for example) helthcheck of current enabled rules. bruteforce and geolocation based rules detection