What's changed: Created SC-200 Chapter 3 (Domain 1 last-third: custom detection rules from Defender XDR Advanced Hunting (frequency/response actions/entities); Sentinel analytics rules (scheduled/NRT/threat intelligence/machine learning Fusion) and anomalies; MITRE ATT&CK coverage view for tactics/techniques coverage analysis and identifying detection gaps).
3.1Custom detection rules in Defender XDR
Understand creating and managing custom detection rules using Advanced Hunting in Microsoft Defender XDR.
Built-in detections cannot catch every org-specific threat or custom behavior. In Defender XDR, promote an Advanced Hunting KQL query into a custom detection rule to detect repeatedly and automatically.
3.1.1Promoting from Advanced Hunting
Analysts write a KQL query representing a threat in Advanced Hunting, validate it, then "create a custom detection rule" to promote it into a scheduled rule. A rule sets run frequency, scope, severity, MITRE ATT&CK mapping, and response actions (isolate device, quarantine file, disable user, etc.). The query must produce alerts/incidents (return appropriate entity columns). Manage existing rules from the list (edit/disable/run history).
Cues: "repeatedly detect a custom KQL in Defender XDR + response actions" = promote an Advanced Hunting query to a custom detection rule. "repeated detection on the Sentinel side" = Sentinel analytics rules (next section)—choose by platform. The query must return entity columns.
Watch the mix-ups: (1) A one-off Advanced Hunting query (exploration) vs the promoted custom detection rule (repeated detection). (2) Defender XDR custom detection rules and Sentinel analytics rules are features of different platforms. (3) For a detection rule, the query must return entities (DeviceId/AccountSid, etc.).
3.1.2Section summary
- Promote an Advanced Hunting KQL into a custom detection rule = scheduled repeated detection + response actions
- Set frequency/severity/MITRE mapping/response (isolate/disable); the query returns entity columns
- Defender XDR custom detection rules vs Sentinel analytics rules—choose by platform
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. In Defender XDR, you want a KQL query for an org-specific threat to detect repeatedly and isolate the device on a hit. Which is best?
Q2. What must a KQL query meet to become a custom detection rule?
Q3. Which correctly distinguishes a one-off Advanced Hunting query from a custom detection rule?
Q4. Which correctly relates Defender XDR custom detection rules and Sentinel analytics rules?
Q5. Which is a valid management action for an existing custom detection rule?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.