What's changed: Created SC-200 Chapter 3 (Domain 1 last-third: custom detection rules from Defender XDR Advanced Hunting (frequency/response actions/entities); Sentinel analytics rules (scheduled/NRT/threat intelligence/machine learning Fusion) and anomalies; MITRE ATT&CK coverage view for tactics/techniques coverage analysis and identifying detection gaps).
3.2Sentinel analytics rules and anomalies
Understand configuring/managing Microsoft Sentinel analytics rules (scheduled, near-real-time NRT, threat intelligence, machine learning) and Sentinel anomalies.
The core of Microsoft Sentinel detection is analytics rules, which evaluate ingested logs to generate alerts/incidents. Analysts choose a rule type by requirement (detection speed, target, false-positive tolerance).
3.2.1The four analytics-rule types
Scheduled runs a KQL query periodically—the most common type (flexible, used for most detection). Near-real-time (NRT) evaluates about every minute for time-sensitive detection (with query constraints). Threat intelligence (TI) auto-matches ingested threat indicators (IOCs) against logs. Machine learning (ML) detects advanced threats via Microsoft-provided Fusion (multistage-attack correlation), etc. Anomalies additionally detect "deviation from normal" in a UEBA-like manner.
Cues: "flexible KQL on a schedule (most detection)" = scheduled analytics rule. "~1-minute interval, time-sensitive" = NRT. "auto-match ingested IOCs against logs" = threat-intelligence analytics rule. "advanced detection like multistage-attack correlation" = ML (Fusion). "deviation from normal" = anomalies.
Watch the mix-ups: (1) Scheduled (flexible, wider intervals) vs NRT (~1 minute, query constraints). (2) TI rules are IOC-matching only—not arbitrary KQL. (3) ML/Fusion and anomalies use Microsoft-provided logic, distinct from your own scheduled KQL rules.
3.2.2Section summary
- Analytics rules = scheduled (flexible/most) · NRT (~1 min/time-sensitive) · TI (IOC matching) · ML (Fusion advanced)
- Anomalies = detect deviation from normal in a UEBA-like manner
- Analytics rules evaluate logs and generate alerts/incidents
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to auto-match ingested threat indicators (malicious IPs/domains/hashes) against your logs to detect. Which Sentinel analytics-rule type is best?
Q2. For time-sensitive detection, you want near-real-time evaluation (about every minute). Which is best?
Q3. You want flexible KQL on a schedule to implement most of your detections. Which is best?
Q4. Which Microsoft-provided logic correlates multistage, multi-domain attacks for advanced detection?
Q5. Which Sentinel feature detects "deviation from normal" for legitimate users/entities?