Skip to Content
SecurityThreat IntelligenceCustom Detections

Custom Detections

Create custom detection rules using KQL (Kusto Query Language) to find specific threat patterns in your environment.

Detection Rule Components

ComponentDescription
QueryKQL query against advanced hunting tables
FrequencyHow often the query runs (1-24 hours)
Alert titleName for generated alerts
SeverityAlert severity level
ActionsAutomated response actions

Creating a Rule

  1. Write and test a KQL query in Advanced Hunting
  2. Save as detection rule with alert configuration
  3. Set run frequency and lookback period
  4. Configure response actions
  5. Enable the rule

Response Actions

  • Isolate device — Network-isolate affected device
  • Quarantine file — Quarantine detected malicious file
  • Restrict app — Block app execution on device
  • Run investigation — Start automated investigation

API Reference

  • GET /api/security/custom-detections — List detection rules
  • POST /api/security/custom-detections — Create rule
  • PUT /api/security/custom-detections/:id — Update rule
Last updated on
Advanced HuntingThreat Analytics