How to Create Analytics Rules in Microsoft Sentinel

Analytics rules are the core detection engine in Microsoft Sentinel, continuously monitoring your security data for threats and suspicious activities. This guide covers creating custom scheduled analytics rules using Kusto Query Language (KQL) to detect threats specific to your environment.

Prerequisites

Before creating analytics rules, ensure you have:

• Microsoft Sentinel workspace with data connectors configured
• Microsoft Sentinel Contributor role or higher
• Basic KQL knowledge for writing detection queries
• Understanding of your data sources and their table schemas
• Threat scenarios you want to detect defined

Understanding Analytics Rule Types

Microsoft Sentinel supports several analytics rule types:

This guide focuses on Scheduled rules, the most flexible and commonly customized type.

Step 1: Design Your Detection Query

Before creating a rule in the UI, design and test your KQL query in the Logs blade.

Basic Query Structure

// 1. Specify the data table
SigninLogs
// 2. Filter the time range (use parameter in actual rule)
| where TimeGenerated > ago(1h)
// 3. Apply detection logic
| where ResultType != 0  // Failed sign-ins
| where AppDisplayName != "Windows Sign In"
// 4. Aggregate or summarize
| summarize FailedAttempts = count() by UserPrincipalName, IPAddress
// 5. Apply threshold
| where FailedAttempts > 10
// 6. Project relevant fields for the alert
| project UserPrincipalName, IPAddress, FailedAttempts

Common Detection Patterns

Brute Force Detection:

SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType == 50126  // Invalid username or password
| summarize
    FailedAttempts = count(),
    DistinctUsers = dcount(UserPrincipalName)
    by IPAddress, bin(TimeGenerated, 10m)
| where FailedAttempts > 20
| project TimeGenerated, IPAddress, FailedAttempts, DistinctUsers

Suspicious Process Execution:

SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 4688  // Process creation
| where NewProcessName has_any ("powershell.exe", "cmd.exe", "wscript.exe")
| where CommandLine has_any ("-enc", "-encodedcommand", "downloadstring", "invoke-expression")
| project TimeGenerated, Computer, Account, NewProcessName, CommandLine

Anomalous Sign-in Location:

SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0  // Successful sign-ins
| summarize
    Countries = make_set(LocationDetails.countryOrRegion),
    CountryCount = dcount(LocationDetails.countryOrRegion)
    by UserPrincipalName
| where CountryCount > 2
| project UserPrincipalName, Countries, CountryCount

Test Your Query

1. Go to Logs in Microsoft Sentinel
2. Paste your query and click Run
3. Verify results match expected detections
4. Adjust thresholds and filters as needed
5. Note the query run time - optimize if over 30 seconds

Step 2: Create a Scheduled Analytics Rule

Access the Analytics Rules Wizard

1. In Microsoft Sentinel, go to Configuration > Analytics
2. Click Create > Scheduled query rule

Configure General Settings

Step 1: General

Example configuration:

• Name: Brute Force Attack - Failed Sign-ins from Single IP
• Description: Detects when a single IP address has more than 20 failed sign-in attempts within 10 minutes, indicating a potential brute force or password spraying attack.
• Severity: Medium
• Tactics: Credential Access
• Techniques: T1110 - Brute Force

Set the Rule Query

Step 2: Set rule logic

1. Paste your tested KQL query in the Rule query field:

SigninLogs
| where ResultType == 50126
| summarize
    FailedAttempts = count(),
    TargetedUsers = make_set(UserPrincipalName),
    UserCount = dcount(UserPrincipalName)
    by IPAddress, bin(TimeGenerated, 10m)
| where FailedAttempts > 20
| extend AlertTime = TimeGenerated
| project AlertTime, IPAddress, FailedAttempts, UserCount, TargetedUsers

2. Configure Alert enrichment options if needed

Configure Entity Mapping

Entity mapping links query results to Sentinel entities, enabling investigation features:

1. Click Add new entity
2. Map your query columns to entity types:

Example mappings for the brute force rule:

• IP Entity: Address = IPAddress
• Account Entity: FullName = TargetedUsers (if single user)

Set Query Scheduling

Configure how often the rule runs and the data lookback period:

Important: The lookup period should be at least as long as your query frequency to avoid gaps. For a 1-hour frequency, use at least 1-hour lookback.

Configure Alert Threshold

Define when alerts should trigger:

• Generate alert when number of query results: Is greater than 0
• Adjust threshold based on your detection logic

For rules that use summarize, the threshold applies to the number of result rows, not the aggregated counts.

Set Event Grouping

Control how alerts are grouped:

For most detections, grouping all events provides cleaner incident management.

Step 3: Configure Incident Settings

Step 3: Incident settings

Enable Incident Creation

1. Toggle Create incidents from alerts to Enabled
2. Configure Alert grouping:
   • Group related alerts into incidents: Enabled
   • Grouping method: By entities or by time period
   • Re-open closed matching incidents: Configure based on workflow

Alert Grouping Options

Step 4: Configure Automated Response

Step 4: Automated response

Link automation rules or playbooks to respond automatically:

1. Under Automation rules, click Add new
2. Configure the automation rule:
   • Trigger: When alert is created
   • Actions: Run playbook, change severity, assign owner, add tags
3. Alternatively, attach existing playbooks directly

Example automation actions:

• Automatically assign incidents to the SOC team
• Add "Brute-Force" tag for categorization
• Run enrichment playbook to gather threat intelligence

Step 5: Review and Create

Step 5: Review and create

1. Review all configuration settings
2. Click Create to save the rule
3. The rule will begin running at the next scheduled interval

Step 6: Monitor Rule Performance

View Rule Execution History

1. Go to Analytics > Rule templates tab
2. Select your custom rule
3. Click View rule details
4. Review the Last run and Status columns

Check for Errors

Common rule issues:

• Query timeout: Optimize KQL query performance
• No results: Verify data exists in the specified tables
• Too many results: Adjust thresholds or add filters

Review Generated Incidents

1. Go to Threat management > Incidents
2. Filter by your rule name
3. Verify alerts are being grouped correctly
4. Check entity mapping is working as expected

Example: Complete Suspicious PowerShell Rule

Here's a complete example of a production-ready analytics rule:

General Settings:

• Name: Suspicious PowerShell Command Execution
• Severity: High
• MITRE: Execution (T1059.001)

Rule Query:

let SuspiciousCommands = dynamic([
    "downloadstring", "downloadfile", "invoke-expression",
    "iex", "-encodedcommand", "-enc", "bypass",
    "hidden", "noprofile", "unrestricted"
]);
SecurityEvent
| where EventID == 4688
| where NewProcessName endswith "\\powershell.exe" or
        NewProcessName endswith "\\pwsh.exe"
| where CommandLine has_any (SuspiciousCommands)
| project
    TimeGenerated,
    Computer,
    Account,
    CommandLine,
    ParentProcessName,
    NewProcessName
| extend
    HostName = tostring(split(Computer, ".")[0]),
    DomainName = tostring(split(Account, "\\")[0]),
    UserName = tostring(split(Account, "\\")[1])

Entity Mapping:

• Host: HostName, DomainName
• Account: Name = UserName, Domain = DomainName

Scheduling:

• Frequency: 5 minutes
• Lookback: 10 minutes

Best Practices for Analytics Rules

Next Steps

After creating your analytics rules:

1. Fine-tune rules based on initial alert quality
2. Create automation rules for incident handling
3. Build workbooks to visualize detection metrics
4. Set up playbooks for automated response
5. Establish a rule review cadence for continuous improvement

Additional Resources

• KQL Quick Reference
• Microsoft Sentinel Analytics Rules
• MITRE ATT&CK Framework
• Sentinel GitHub - Rule Templates

Need help building effective detection rules? Inventive HQ specializes in SIEM engineering and can help you develop custom analytics rules tailored to your threat landscape. Contact us for a free consultation.