What's changed: Created SC-200 Chapter 3 (Domain 1 last-third: custom detection rules from Defender XDR Advanced Hunting (frequency/response actions/entities); Sentinel analytics rules (scheduled/NRT/threat intelligence/machine learning Fusion) and anomalies; MITRE ATT&CK coverage view for tactics/techniques coverage analysis and identifying detection gaps).
3.1Custom detection rules in Defender XDR
Understand creating and managing custom detection rules using Advanced Hunting in Microsoft Defender XDR.
Built-in detections cannot catch every org-specific threat or custom behavior. In Defender XDR, promote an Advanced Hunting KQL query into a custom detection rule to detect repeatedly and automatically.
3.1.1Promoting from Advanced Hunting
Analysts write a KQL query representing a threat in Advanced Hunting, validate it, then "create a custom detection rule" to promote it into a scheduled rule. A rule sets run frequency, scope, severity, MITRE ATT&CK mapping, and response actions (isolate device, quarantine file, disable user, etc.). The query must produce alerts/incidents (return appropriate entity columns). Manage existing rules from the list (edit/disable/run history).
Cues: "repeatedly detect a custom KQL in Defender XDR + response actions" = promote an Advanced Hunting query to a custom detection rule. "repeated detection on the Sentinel side" = Sentinel analytics rules (next section)—choose by platform. The query must return entity columns.
Watch the mix-ups: (1) A one-off Advanced Hunting query (exploration) vs the promoted custom detection rule (repeated detection). (2) Defender XDR custom detection rules and Sentinel analytics rules are features of different platforms. (3) For a detection rule, the query must return entities (DeviceId/AccountSid, etc.).
3.1.2Section summary
- Promote an Advanced Hunting KQL into a custom detection rule = scheduled repeated detection + response actions
- Set frequency/severity/MITRE mapping/response (isolate/disable); the query returns entity columns
- Defender XDR custom detection rules vs Sentinel analytics rules—choose by platform
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. In Defender XDR, you want a KQL query for an org-specific threat to detect repeatedly and isolate the device on a hit. Which is best?
Q2. What must a KQL query meet to become a custom detection rule?
Q3. Which correctly distinguishes a one-off Advanced Hunting query from a custom detection rule?
Q4. Which correctly relates Defender XDR custom detection rules and Sentinel analytics rules?
Q5. Which is a valid management action for an existing custom detection rule?