Selecting Microsoft Sentinel Analytic Rule Types

This scenario requires selecting the correct Microsoft Sentinel analytic rule types for two distinct detection needs. The key is understanding how different rule templates process data and generate alerts.

Rule 1: Automatically match Common Event Format (CEF) logs and syslog data with domain, IP address, and URL indicators. This describes a Threat Intelligence rule. Threat intelligence rules in Microsoft Sentinel are designed to enrich and correlate incoming log data (such as CEF, Syslog, or Windows DNS events) against external threat intelligence feeds. These feeds contain known malicious indicators of compromise (IOCs), such as IP addresses, domains, and URLs. When an event matches an indicator, the rule generates an alert. This is a deterministic, lookup-based approach rather than a statistical one.

Rule 2: Use Microsoft proprietary algorithms. This refers to Machine Learning (ML) Behavioral Analytics. Microsoft provides pre-built ML behavioral analytics templates that use proprietary algorithms to detect anomalies and unusual patterns in user and entity behavior. These rules do not rely on static IOCs but instead establish baselines of normal activity and flag deviations. Examples include detecting impossible travel, anomalous login locations, or unusual file access patterns. This is a probabilistic, pattern-recognition approach.

The common mistake is confusing these two mechanisms. Learners might incorrectly select 'Custom Query' for Rule 1 because it involves matching, but Custom Queries require writing Kusto Query Language (KQL) code manually, whereas Threat Intelligence rules automate this matching against predefined indicators. Similarly, learners might choose 'Scheduled' rules for Rule 2, but Scheduled rules also rely on static thresholds or logic, not dynamic machine learning models.