Active analytics rules are configured in Microsoft Sentinel to detect threats

Overview

Analytics rules are the detection engine of Microsoft Sentinel. Scheduled rules run KQL queries on a schedule (typically every 5 minutes to 1 hour); Near-Real-Time (NRT) rules evaluate the last minute of data on every event arrival; Microsoft Security rules forward Microsoft Defender alerts as Sentinel incidents; Fusion rules use Microsoft machine learning to correlate low-fidelity signals across data sources into high-fidelity, multi-stage incidents; Threat Intelligence rules match indicators from the threat-intel store against ingested telemetry; UEBA rules surface anomalous user/entity behavior; ML Behavior Analytics rules surface anomalous SSH and RDP login patterns. Without active analytics rules, the workspace ingests data but generates zero incidents — every threat actor TTP that could be detected passes without alerting. Microsoft publishes hundreds of analytics rule templates; production deployments enable a curated subset matched to the connector inventory and tune them over time. The check confirms at least one analytics rule is enabled and the workspace has more than zero rules across the documented kinds.

Remediation

• Detect threats out-of-the-box with Microsoft Sentinel analytics rules
• Create custom analytics rules to detect threats
• Microsoft Sentinel content hub

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	SecOps
Category	Security information and event management
Product	Azure
Feature	Microsoft Sentinel
Area	Logging and detection
Licence	Consumption-based: Microsoft Sentinel
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.