How a rule runs
Every enabled rule has a cadence and a lookback window. On each pass the detection engine evaluates the rule's query over the window, groups matches by the rule's entity (a host, a user, an address), and writes one alert per entity per window. Alert identifiers are deterministic: the same rule matching the same entity in the same window produces the same alert, so a rule that runs again never creates a duplicate and never overwrites the triage an analyst has already done.
Rule types
| Rule type | Matches when |
|---|---|
| Custom query (Sigma), Search query (XQL), Event query (EQL) | An event satisfies the query. |
| Threshold | At least N matching events for one entity in the window. |
| Sequence | Ordered stages happen for one entity within the window: stage A, then B, then C. |
| Correlation | Several conditions happen for one entity in any order within the window. |
| Behavioral | Something is seen for the first time on a host or account, such as a new process image or a new parent and child pair. |
| Indicator match | An event matches an active threat intelligence indicator. |
Sequence and correlation rules express behaviours such as "a burst of failed logons, then a success, then a new service" without a separate correlation product.
Where rules come from
- The content pack shipped with the platform: ATT&CK-tagged rules with test events. See Content pack.
- Sigma rules you import, compiled to native rules and staged disabled for review. See Importing.
- KQL and EQL subsets, compiled the same way.
- Indicator match rules that follow your threat intelligence lists as they change. See Threat intelligence.
- Rules your team writes in the editor. See Writing rules.
After the match
- The alert appears in the queue with its severity, entity, ATT&CK technique and the rule that raised it.
- The playbook bound to the rule runs, if any.
- Correlation looks for related alerts and may attach the alert to a correlation. See Correlations.
- Suppressions are checked before an alert is written, so suppressed matches never reach the queue or start an SLA clock. See Exceptions and suppressions.
Rule inspector
Select a rule to see its hits over seven days, its false-positive rate from analyst dispositions, how often analysts agreed with its AI verdicts, its bound playbook and a Run now replay. Use it to decide what to tune.