Domain 1 of 3 · Chapter 4 of 4

Configure detections

Unlock the complete study guide + 25 practice exams totaling 1,498 questions.

Bundled into the existing Microsoft Certified: Security Operations Analyst Associate premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Detection rules in three families
  • Preparing a custom detection query
  • Custom detection frequency and lookback
  • Custom detection alert details and enrichment
  • Custom detection response actions
  • Custom detection rule scope
  • Managing existing custom detection rules
  • Scheduled rules from Content hub templates
  • Scheduled rule query requirements
  • Scheduled rule timing: interval, lookback, first run
  • Controlling scheduled rule output
  • Alert enhancement in Sentinel analytics rules
  • NRT analytics rules
  • Managed-logic rules: threat intelligence, Fusion, ML
  • Anomaly rules and the Flighting cycle
  • Analyzing coverage with the MITRE ATT&CK matrix
  • Practice: configuring custom detections and Sentinel analytics rules

Query-based rules: custom detection vs scheduled rule vs NRT rule

SettingCustom detection (Defender XDR)Scheduled rule (Sentinel)NRT rule (Sentinel)
Where you build itAdvanced hunting or the Custom detection rules page in the Defender portalAnalytics rule wizard, from a template or from scratchAnalytics rule wizard, from a template or from scratch
Run frequencyContinuous (NRT), hourly, 3, 12, or 24 hours; Custom 5 minutes to 14 days for Sentinel-only dataRun query every: 5 minutes to 14 daysFixed: once every minute
LookbackFixed pair with Defender data (hourly reads 4 hours, 24 hours reads 30 days); configurable for Sentinel-only dataLookup data from the last: 5 minutes to 14 days, never shorter than the intervalEvents ingested in the preceding minute
Time basis and delayingestion_time(), so late-arriving events are still evaluatedBuilt-in five-minute delayIngestion time, two-minute delay
Alerts per runUp to 150Up to 150; per-event mode gives 149 alerts plus a summary only when results exceed 150 eventsUp to 30; per-event mode gives 29 alerts plus a summary only when results exceed 30 events
Multiple tablesYes, except at Continuous (NRT): one table, no joins or unionsYes; no search * or union *Yes, across tables and workspaces
Built-in response actionsYes on Defender data: device, file, user, and email actionsNone; respond through automation rules and playbooksNone; respond through automation rules and playbooks

Decision tree

A suggested starting point.Custom detections can alsoread Sentinel-only data.Can you read and editthe KQL?NoYesShould findingsraise alerts?Defender data, orbuilt-in actions?YesYesNoNoManaged-logicruleCustom detectionDefender XDRAnomaly ruleAnomalies tableMust it runevery minute?YesNoNRT rule30-alert capScheduled rule5 min to 14 daysAlways: tag MITRE ATT&CKtechniques, then check coverage
Cheat sheet

Cheat sheet

  • Custom detection output should preserve identifiers for the original event
  • arg_max can retain a coherent source event in an aggregated detection
  • AccountUpn can map a custom detection result to the affected user
  • Custom detection email actions require both message and recipient identifiers
  • A custom detection can produce only 150 alerts per run
  • Continuous custom detections require a supported single-table query
  • Device scope limits endpoint detection data and actions but not identity-only rules
  • Custom detection enrichment binds projected fields to presentation and entity categories
  • Custom detection response targets depend on action-specific identifiers
  • Oversized custom detection details are discarded as a whole array
  • Multi-source custom detections require permissions for every targeted workload
  • Running a custom detection on demand resets its next-run interval
  • Rule details separately expose triggered alerts and triggered actions
  • Turning a detection off preserves it while deletion permanently removes it
  • Custom frequency is available for Sentinel-only detection queries
  • Custom detections participate in correlation by default
  • Defender custom detection frequency determines its fixed lookback
  • Custom detections accommodate late ingestion and group repeated matching events
  • Sentinel-only custom detections expose a frequency-bounded lookback setting
  • Migrate now updates selected compatible detections to Continuous frequency
  • A scheduled rule's interval must not exceed its lookback
  • Scheduled analytics run with a built-in five-minute delay
  • Scheduled alert thresholds apply to each run's query results
  • Per-event scheduled alerting uses a summary alert when results exceed its limit
  • Scheduled-rule suppression stops the query temporarily after an alert
  • Entity mapping creates recognized entities while custom details expose extra fields
  • A template update does not silently replace a customized analytics rule
  • Results simulation previews the last 50 scheduled evaluations
  • Incident settings group alerts separately from the query's event grouping
  • Dynamic alert details override standard properties using query output
  • Scheduled analytics queries must satisfy rule-specific syntax and schema constraints
  • Scheduled template creation is gated by connected and ingesting sources
  • Scheduled rules need explicit activation controls to defer their first execution
  • Sentinel NRT evaluates one-minute ingestion windows
  • Sentinel NRT queries can span multiple tables and workspaces
  • NRT per-event alerting caps output at 30 alerts
  • Microsoft's threat intelligence matching rule uses managed detection logic
  • Threat intelligence matching depends on populated fields in supported tables
  • Fusion correlates lower-fidelity signals into multistage attack incidents
  • Defender incident integration makes the standalone Fusion rule unavailable
  • ML Behavior Analytics detects anomalous SSH and RDP logins with managed models
  • The MITRE matrix shows configured detection coverage rather than proof of prevention
  • Simulated MITRE coverage represents available but unconfigured detections
  • Technique drilldown connects coverage gaps to relevant rules and hunting content
  • Rule-level ATT&CK mappings propagate to generated alerts and incidents
  • Anomaly rules record deviations without generating their own alerts
  • Customize an anomaly by duplicating its built-in rule
  • A customized anomaly starts disabled in Flighting mode
  • AnomalyTemplateId links original and customized results for comparison
  • Promoting the customized anomaly automatically moves the original to Flighting
  • Changing an anomaly's template version requires recreating the rule
  • UEBA evaluates behavior against personal, peer, and organizational history

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. https://learn.microsoft.com/en-us/azure/sentinel/threat-detection
  2. https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules
  3. https://learn.microsoft.com/en-us/defender-xdr/custom-detection-manage
  4. https://learn.microsoft.com/en-us/azure/sentinel/work-with-anomaly-rules
  5. https://learn.microsoft.com/en-us/azure/sentinel/near-real-time-rules
  6. https://learn.microsoft.com/en-us/azure/sentinel/scheduled-rules-overview
  7. https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts
  8. https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table
  9. https://learn.microsoft.com/en-us/kusto/query/arg-max-aggregation-function
  10. https://learn.microsoft.com/en-us/azure/sentinel/scoping
  11. https://learn.microsoft.com/en-us/defender-xdr/exclude-analytics-rules-correlation
  12. https://learn.microsoft.com/en-us/kusto/query/bag-unpack-plugin
  13. https://learn.microsoft.com/en-us/azure/sentinel/map-data-fields-to-entities
  14. https://learn.microsoft.com/en-us/azure/sentinel/surface-custom-details-in-alerts
  15. https://learn.microsoft.com/en-us/azure/sentinel/customize-alert-details
  16. https://learn.microsoft.com/en-us/azure/sentinel/use-matching-analytics-to-detect-threats
  17. https://learn.microsoft.com/en-us/azure/sentinel/anomalies-reference
  18. https://learn.microsoft.com/en-us/azure/sentinel/mitre-coverage