# Active analytics rules are configured in Microsoft Sentinel to detect threats
Analytics rules are the detection engine of Microsoft Sentinel.
Source: https://maester.dev/docs/tests/ZTA.41207
## Overview
Analytics rules are the detection engine of Microsoft Sentinel. Scheduled rules run KQL queries on a schedule (typically every 5 minutes to 1 hour); Near-Real-Time (NRT) rules evaluate the last minute of data on every event arrival; Microsoft Security rules forward Microsoft Defender alerts as Sentinel incidents; Fusion rules use Microsoft machine learning to correlate low-fidelity signals across data sources into high-fidelity, multi-stage incidents; Threat Intelligence rules match indicators from the threat-intel store against ingested telemetry; UEBA rules surface anomalous user/entity behavior; ML Behavior Analytics rules surface anomalous SSH and RDP login patterns. Without active analytics rules, the workspace ingests data but generates zero incidents — every threat actor TTP that could be detected passes without alerting. Microsoft publishes hundreds of analytics rule templates; production deployments enable a curated subset matched to the connector inventory and tune them over time. The check confirms at least one analytics rule is enabled and the workspace has more than zero rules across the documented kinds.
## Remediation
- [Detect threats out-of-the-box with Microsoft Sentinel analytics rules](https://learn.microsoft.com/azure/sentinel/detect-threats-built-in)
- [Create custom analytics rules to detect threats](https://learn.microsoft.com/azure/sentinel/detect-threats-custom)
- [Microsoft Sentinel content hub](https://learn.microsoft.com/azure/sentinel/sentinel-solutions-deploy)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Security information and event management |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Microsoft Sentinel |
| Area | Logging and detection |
| Licence | Consumption-based: Microsoft Sentinel |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.