What's changed: Created SC-200 Chapter 3 (Domain 1 last-third: custom detection rules from Defender XDR Advanced Hunting (frequency/response actions/entities); Sentinel analytics rules (scheduled/NRT/threat intelligence/machine learning Fusion) and anomalies; MITRE ATT&CK coverage view for tactics/techniques coverage analysis and identifying detection gaps).
3.2Sentinel analytics rules and anomalies
Understand configuring/managing Microsoft Sentinel analytics rules (scheduled, near-real-time NRT, threat intelligence, machine learning) and Sentinel anomalies.
The core of Microsoft Sentinel detection is analytics rules, which evaluate ingested logs to generate alerts/incidents. Analysts choose a rule type by requirement (detection speed, target, false-positive tolerance).
3.2.1The four analytics-rule types
Scheduled runs a KQL query periodically—the most common type (flexible, used for most detection). Near-real-time (NRT) evaluates about every minute for time-sensitive detection (with query constraints). Threat intelligence (TI) auto-matches ingested threat indicators (IOCs) against logs. Machine learning (ML) detects advanced threats via Microsoft-provided Fusion (multistage-attack correlation), etc. Anomalies additionally detect "deviation from normal" in a UEBA-like manner.
Cues: "flexible KQL on a schedule (most detection)" = scheduled analytics rule. "~1-minute interval, time-sensitive" = NRT. "auto-match ingested IOCs against logs" = threat-intelligence analytics rule. "advanced detection like multistage-attack correlation" = ML (Fusion). "deviation from normal" = anomalies.
Watch the mix-ups: (1) Scheduled (flexible, wider intervals) vs NRT (~1 minute, query constraints). (2) TI rules are IOC-matching only—not arbitrary KQL. (3) ML/Fusion and anomalies use Microsoft-provided logic, distinct from your own scheduled KQL rules.
3.2.2Section summary
- Analytics rules = scheduled (flexible/most) · NRT (~1 min/time-sensitive) · TI (IOC matching) · ML (Fusion advanced)
- Anomalies = detect deviation from normal in a UEBA-like manner
- Analytics rules evaluate logs and generate alerts/incidents
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to auto-match ingested threat indicators (malicious IPs/domains/hashes) against your logs to detect. Which Sentinel analytics-rule type is best?
Q2. For time-sensitive detection, you want near-real-time evaluation (about every minute). Which is best?
Q3. You want flexible KQL on a schedule to implement most of your detections. Which is best?
Q4. Which Microsoft-provided logic correlates multistage, multi-domain attacks for advanced detection?
Q5. Which Sentinel feature detects "deviation from normal" for legitimate users/entities?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.