A scheduled query rule in Microsoft Sentinel repeatedly runs threat-detection logic at a chosen interval to find activities that may be malicious. Use built-in scheduled templates where they fit, customize them for local needs, or create a rule from scratch for an organization-specific use case. section 8.4.3 section 8.4.2
Rules turn relevant ingested data into detections. A query can be tested against current data before deployment; the simulation charts expected daily results against an alert threshold. Results above that threshold create an incident for investigation. section 8.13 section 8.4.4
Configure a scheduled query rule through the Sentinel Analytics wizard:
- Create a Scheduled Query Rule and provide a name, description, tactic and technique, severity, and enabled status. section 8.4.4
- Set rule logic, including the query, schedule, and alert threshold; test it with current data to assess expected results. section 8.4.4
- Continue through incident settings and automated response, then review and create the rule. section 8.11
Detect repeated failed sign-ins
A high-severity rule can flag a possible brute-force attack when a user has more than 10 failed logins within five minutes. Classify it under Credential Access and T1110 – Brute Force, then use the resulting incident for follow-up investigation. section 8.4.4
SecurityEvent | where TimeGenerated >= ago(1d) | where EventID == 4625 | summarize FailedLogins=count() by Account, Computer | sort by FailedLogins desc
This query filters failed-login events, counts them by account and computer, and sorts the highest counts first; it supplies detection logic for a scheduled rule. section 8.4.4
Detect virtual machine deletion
A rule named VMs Deleted in Production can query AzureActivity for successful Delete Virtual Machine operations, classify the behavior as Impact and T0828 – Loss of Productivity and Revenue, and assign Medium severity. section 8.11
