Microsoft Sentinel
Cloud and workloadsConfigure Fusion Rules
In brief
The page’s publication date and authoring metadata were updated, and several Fusion descriptions and scheduled analytics rule guidance were reworded for clarity, including the Customer-Managed Keys link text.
What Defender admins need to know
No administrator action is specified; use the updated guidance when reviewing Fusion configuration.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
#Customer intent: As a security engineer, I want to configure multistage attack detection rules so that analysts can more easily identify and respond to complex multistage threats with high accuracy. [!INCLUDE reference-to-feature-availability]
Microsoft Sentinel uses Fusion, a correlation engine based on scalable machine learning algorithms, to automatically detect multistage attacks by identifying combinations of anomalous behaviors and suspicious activities that are observed at various stages of the attack chain. Based on these discoveries,detected attack patterns, Microsoft Sentinel generates incidents that would otherwise be difficult to catch. These incidents comprise two or more alerts or activities. By design, these incidents are low-volume, high-fidelity, and high-severity.
Customized for your environment, this detection technology not only reduces false positive rates but can also detect attacks with limited or missing information.
Configure scheduled analytics rules for Fusion detections
Fusion detects scenario-based multistage attacks and emerging threats by using alerts generated by scheduled analytics rules. To get the most out of Microsoft Sentinel's Fusion capabilities, take the following steps to configure and enable these rules.
Fusion for emerging threats uses alerts generated by any scheduled analytics rules that contain kill-chain (tactics) and entity mapping information. To ensure that Fusion can use
analerts from a scheduled analytics rule's outputto detect emergingthreats:threats, verify the rule's entity mapping and tactics configuration:- Review entity mapping for these scheduled rules. Use the entity mapping configuration section to map parameters from your query results to Microsoft Sentinel-recognized entities. Because Fusion correlates alerts based on entities (such as user account or IP address), its ML algorithms can't perform alert matching without the entity information.
@@ -5,8 +5,8 @@ ms.author: guywild author: guywi-ms ms.reviewer: noak ms.topic: how-to-ms.date: 06/15/2026-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014+ms.date: 07/02/2026+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016 ai-usage: ai-assisted #Customer intent: As a security engineer, I want to configure multistage attack detection rules so that analysts can more easily identify and respond to complex multistage threats with high accuracy.@@ -23,7 +23,7 @@ ai-usage: ai-assisted [!INCLUDE [reference-to-feature-availability](includes/reference-to-feature-availability.md)] -Microsoft Sentinel uses Fusion, a correlation engine based on scalable machine learning algorithms, to automatically detect multistage attacks by identifying combinations of anomalous behaviors and suspicious activities that are observed at various stages of the attack chain. Based on these discoveries, Microsoft Sentinel generates incidents that would otherwise be difficult to catch. These incidents comprise two or more alerts or activities. By design, these incidents are low-volume, high-fidelity, and high-severity.+Microsoft Sentinel uses Fusion, a correlation engine based on scalable machine learning algorithms, to automatically detect multistage attacks by identifying combinations of anomalous behaviors and suspicious activities that are observed at various stages of the attack chain. Based on these detected attack patterns, Microsoft Sentinel generates incidents that would otherwise be difficult to catch. These incidents comprise two or more alerts or activities. By design, these incidents are low-volume, high-fidelity, and high-severity. Customized for your environment, this detection technology not only reduces [false positive](false-positives.md) rates but can also detect attacks with limited or missing information. @@ -95,7 +95,7 @@ The Fusion analytics rule is enabled by default in Microsoft Sentinel. To check > [!NOTE]-> Microsoft Sentinel currently uses 30 days of historical data to train the machine learning systems. This data is always encrypted with Microsoft’s keys as it passes through the machine learning pipeline. However, the training data isn't encrypted with [Customer-Managed Keys (CMK)](customer-managed-keys.md) if you enable CMK in your Microsoft Sentinel workspace. To opt out of Fusion, go to **Microsoft Sentinel** \> **Configuration** \> **Analytics \> Active rules**, right-click on the **Advanced Multistage Attack Detection** rule, and select **Disable.**+> Microsoft Sentinel currently uses 30 days of historical data to train the machine learning systems. This data is always encrypted with Microsoft’s keys as it passes through the machine learning pipeline. However, the training data isn't encrypted with [customer-managed keys (CMK)](customer-managed-keys.md), which are encryption keys that you create and manage in Azure Key Vault, even if you enable CMK in your Microsoft Sentinel workspace. To opt out of Fusion, go to **Microsoft Sentinel** \> **Configuration** \> **Analytics \> Active rules**, right-click on the **Advanced Multistage Attack Detection** rule, and select **Disable.** ## Configure scheduled analytics rules for Fusion detections @@ -105,7 +105,7 @@ The Fusion analytics rule is enabled by default in Microsoft Sentinel. To check **Fusion** detects scenario-based multistage attacks and emerging threats by using alerts generated by [scheduled analytics rules](detect-threats-custom.md). To get the most out of Microsoft Sentinel's Fusion capabilities, take the following steps to configure and enable these rules. -1. Fusion for emerging threats uses alerts generated by any [scheduled analytics rules](scheduled-rules-overview.md) that contain kill-chain (tactics) and entity mapping information. To ensure that Fusion can use an analytics rule's output to detect emerging threats:+1. Fusion for emerging threats uses alerts generated by any [scheduled analytics rules](scheduled-rules-overview.md) that contain kill-chain (tactics) and entity mapping information. To ensure that Fusion can use alerts from a scheduled analytics rule to detect emerging threats, verify the rule's entity mapping and tactics configuration: - Review **entity mapping** for these scheduled rules. Use the [entity mapping configuration section](map-data-fields-to-entities.md) to map parameters from your query results to Microsoft Sentinel-recognized entities. Because Fusion correlates alerts based on entities (such as *user account* or *IP address*), its ML algorithms can't perform alert matching without the entity information.