An introduction to Microsoft Sentinel Analytics

Microsoft Sentinel Analytics is where you set up rules to find potential issues with your environment. You can create various types of rules, each with their own configuration steps and unique options for the types of abnormalities you are trying to detect.

Types of analytic rules

There are currently five types of rules: scheduled, Microsoft Security, machine learning, Fusion, and anomaly. Each type of rule fills a specific niche. Let's explore each of these in turn.

Scheduled

As the name suggests, these rules run on a set schedule to detect suspicious events. For instance, you can have a rule run every few minutes, every hour, every day, or at another interval. The queries for these rules will use KQL to define what they are trying to find. These rules will make up a large proportion of your analytic rules and, if you have used other Security Information and Event Management (SIEM) systems, these are probably the ones...