Exactly what are you looking to do? Do you mean what events do you monitor? If so, a good place to start would be the Compliance reports. These show some general areas to look at for monitoring like authentication events, privileged use, configuration changes, user account management, etc.
