Learning path
Microsoft Sentinel - Analytic Rules and Incidents
Skill Level
Fundamentals
Duration 10 minutes
Updated Nov 3, 2026
About this learning path
A saved query only helps when someone remembers to run it. Analytics rules in Microsoft Sentinel run that same query on a schedule, raise an alert when it finds a hit, and group related alerts into one incident for an analyst to work. Follow a single rule from its first idea to an assigned incident in the Microsoft Defender portal.
Your instructors
Prerequisites
- Basic KQL skills: Comfort filtering, projecting, and summarizing rows.
- Data in Sentinel: Logs flowing into a Microsoft Sentinel workspace from at least one data connector.
- Microsoft Defender portal: A working knowledge of the Microsoft Defender portal, including the Microsoft Sentinel section and the incident queue.
- Alerts and incidents: A basic idea of what a security alert is and how a SOC groups alerts into incidents.
What you'll learn
- Choose between scheduled, near-real-time, anomaly, and custom detection rules
- Build a scheduled analytics rule with a query, a schedule, and an alert threshold
- Map entities so alerts can be tied to accounts, hosts, and IP addresses
- Explain how alerts group into incidents and what the Defender correlation engine changes
- Triage an incident from Active to Resolved with the right classification
- Use automation rules to assign, tag, and prioritize incidents