To start detecting threats in Microsoft Sentinel, you create analytics rules that run queries against your data. Navigate to the Analytics screen and open the Rule templates tab. Choose a template that matches the threat you want to monitor, and click Create rule to build an active rule from that template. Each template lists the data sources it needs; those sources must already be connected to Sentinel for the rule to work.
The rule creation wizard lets you change the underlying Kusto Query Language (KQL) query, set how often the rule runs, and define thresholds that control when an alert fires. For example, you can adjust the query to look for a specific event pattern, set the schedule to run every five minutes, and require that the pattern appears at least three times before an alert is created. These settings let you tune the rule to match your environment without generating too many false alarms.
Before you enable the rule, use the Results simulation feature in the wizard to run the query against live data. The simulation shows how many alerts the rule would have produced in the past, helping you see whether the logic is too broad or too narrow. Based on the results, you can adjust the query or thresholds until the detection matches what you expect, then save the rule.
When a rule triggers an alert, you decide how Sentinel turns that alert into an incident. You can configure the rule to create one incident per alert, or group multiple alerts that share the same criteria into a single incident. Incidents are the cases that analysts investigate. You can also attach automated responses, such as playbooks, that run when an incident is created, for example, to block a malicious IP address or open a ticket.
Sentinel offers advanced analytics rule types beyond standard scheduled queries. Near-Real-Time (NRT) rules run continuously and produce alerts within seconds, ideal for fast-moving threats. Anomaly detection rules use machine learning to spot unusual behavior without a fixed query pattern. These capabilities let you layer detection so that slow, periodic queries catch long-running campaigns while NRT and anomaly rules catch immediate or unknown threats.
Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
You can test an analytics rule by using the Results simulation feature in the rule creation wizard to run the query against live data. This simulation displays how many alerts the rule would have produced in the past, helping you determine whether the detection logic is too broad or too narrow before saving the rule.
Near-Real-Time (NRT) rules run continuously and produce alerts within seconds to catch fast-moving threats. In contrast, anomaly detection rules use machine learning to identify unusual behavior without relying on a fixed query pattern.
Automated responses, such as playbooks, can be configured to run automatically whenever an incident is created by an analytics rule. These automated actions can perform tasks such as blocking a malicious IP address or opening a ticket.
StudyCerts
StudyCerts