How a rule runs
Every enabled rule has a cadence and a lookback window. On each pass the detection engine evaluates the rule's query over the window, groups matches by the rule's entity (a host, a user, an address), and writes one alert per entity per window. Alert identifiers are deterministic: the same rule matching the same entity in the same window produces the same alert, so a rule that runs again never creates a duplicate and never overwrites the triage an analyst has already done.
Three shapes
| Shape | Matches when |
|---|---|
| Query | A single event, or at least N events for one entity in the window, satisfies the query. |
| Sequence | Ordered stages happen for one entity within the window: stage A, then B, then C. |
| Correlation | The same stages happen for one entity in any order within the window. |
Query rules are the majority. Sequence and correlation rules express behaviours such as "a burst of failed logons, then a success, then a new service" without a separate correlation product.
Where rules come from
- The content pack shipped with the platform: ATT&CK-tagged rules with test events. See Content pack.
- Sigma rules you import, compiled to native rules and staged disabled for review. See Importing.
- KQL and EQL subsets, compiled the same way.
- Indicator match rules generated from threat intelligence lists. See Threat intelligence.
- Rules your team writes in the editor. See Writing rules.
After the match
- The alert appears in the queue with its severity, entity, ATT&CK technique and the rule that raised it.
- The playbook bound to the rule runs, if any.
- Correlation looks for related alerts and may attach the alert to a correlation. See Correlations.
- Suppressions are checked before an alert is written, so suppressed matches never reach the queue or start an SLA clock. See Exceptions and suppressions.
Rule inspector
Every rule's page shows its hits over seven days, false-positive rate from analyst dispositions, whether the AI verdict tended to agree with analysts on it, who last edited it, and its exceptions. Use it to decide what to tune.