Microsoft 365 Defender Real-Time Custom Detection Rules Previewed -- Redmondmag.com

Microsoft 365 Defender Real-Time Custom Detection Rules Previewed

By Kurt Mackie
03/14/2023

Microsoft 365 Defender users are getting a public preview of the ability to set custom detection rules for near real-time security events, according to a Monday announcement.

Microsoft described some of the scenarios where custom detection rules in near real time could be used. Organizations may want to check for threat activity after a "recently disclosed vulnerability" becomes known. They also may want to check for, and remove, unwanted e-mails, or block "messages that spoof the recipient from a particular IP subnet."

The custom detection rules in near real time preview for Microsoft 365 Defender users will work "across email, endpoint, and identity, leading to faster response times and faster mitigation of threats," Microsoft promised. IT pros configure a custom rule using a wizard. If the custom rule matches an event, then an alert gets automatically sent.

The near real-time detections get set up using a "Continuous" setting. It's a new option on top of the "every one hour" and "every 24 hours" detection options.

The Continuous option only works with when querying one table using a "supported KQL operator." It doesn’t work with "unions or joins," Microsoft noted in this document, which also listed the supported KQL operators.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Multi-Tenant Organization Hooks Released for Microsoft 365

Microsoft Entra ID's new multi-tenant organization capabilities have reached general availability (GA).
Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.