Create and manage custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. In-depth articles on Microsoft developer tools and technologies Personalized learning paths and courses Globally recognized, industry-endorsed credentials Technical questions and answers moderated by Microsoft Code sample library for Microsoft developer tools and technologies Interactive, curated guidance and recommendations Thousands of hours of original programming from Microsoft experts Featured assessment Wherever you are in your AI journey, Microsoft Learn meets you where you are and helps you deepen your skills. Featured assessment Wherever you are in your AI journey, Microsoft Learn meets you where you are and helps you deepen your skills. Featured assessment Wherever you are in your AI journey, Microsoft Learn meets you where you are and helps you deepen your skills. Featured assessment Wherever you are in your AI journey, Microsoft Learn meets you where you are and help

Create custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn Table of contents Exit editor mode Ask Learn Ask Learn Reading mode Table of contents Read in English Add Add to plan Edit Copy Markdown Print Note Access to this page requires authorization. You can try signing in or changing directories . Access to this page requires authorization. You can try changing directories . Create custom detection rules in Microsoft Defender XDR Applies to: Microsoft Defender XDR, Microsoft Sentinel in the Microsoft Defender portal, Microsoft Defender for Endpoint Plan

saved by

• Cooper Edmunds

related reading

• Use customizable anomalies to detect threats in Microsoft Sentinel | Microsoft Learnlearn.microsoft.com
• Anomalies detected by the Microsoft Sentinel machine learning engine | Microsoft Learnlearn.microsoft.com
• Empowering Threat Detection With Custom Detections in EDRtruesec.com
• Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Microsoft Learnlearn.microsoft.com
• What is Detection Engineering and Why do I Need it?cyberseccafe.com
• Tuning YARA-L Rules in Chronicle SIEM | by Chris Martin (@thatsiemguy) | Mediummedium.com
• The dotted lines between Threat Hunting and Detection Engineering | by Alex Teixeira | Detect FYIdetect.fyi
• Build for Detection Engineering, and Alerting Will Improve (Part 3) | by Anton Chuvakin | Anton on Security | Mediummedium.com
• EDR Internals for macOS and Linuxoutflank.nl
• What Is Cyber Threat Hunting? Complete Guide | Exabeamexabeam.com
• Lessons learned from EDR Bypass threat hunting | by Cristóbal Martínez | Mediummedium.com
• Navigating the crossroads of Threat Hunting & Detection Engineering | by Alex Teixeira | Detect FYIdetect.fyi