Cybersecurity/SIEM analysts

What are the top alarms that most other analysts should consider having?

i.e. alarms that give you great results or something you think others don't often think about or even obvious alarms that are often underrated

Suggested format: Alarm name or title and if not self explanatory, what is it looking for. Also include log/event source such as "sysmon logs"

analysts cybersecurity siem