1Log what an investigation will ask for
Authentication (successes and failures), process creation, network connections, DNS queries and administrative changes answer most investigation questions. Send them to one place, with synchronised clocks (NTP), and keep them long enough. Many intrusions are found weeks after they began.
On Windows, event ID 4624 is a successful logon and 4625 a failed one; process creation is 4688 (or Sysmon event 1). Knowing the few IDs that matter makes a log readable.
2Anomaly means unusual for this system
A baseline is what normal looks like for a host, account or service, including its daily and weekly rhythm. The same login count can be routine at 10:00 on a Monday and alarming at 03:00 on a Sunday.
Too many low-value alerts cause alert fatigue: real alerts get missed in the noise. Tuning a detection to fire less, but on the right thing, is detection engineering, not laziness.
3Detection rules you can share
Sigma is an open, generic format for detection rules. A rule written once converts to the query language of many SIEMs. Test a rule against known-bad and known-good activity before trusting it, and map it to an ATT&CK technique so coverage is visible.