Microsoft Sentinel
Cloud and workloadsDetection lifecycle management recommendations
In brief
The Microsoft Sentinel comparison table changed custom detection rules from “No” to “Yes (Preview)” for one management capability. The article’s guidance wording and metadata were also updated.
What Defender admins need to know
Review the comparison table when evaluating lifecycle-management options for custom detection rules. No administrator action is stated.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Detection lifecycle management recommendations
This article provides recommendationsChoose a Microsoft Sentinel capability for managing detections and other content types in Microsoft Sentinel. Use these recommendations to identiy the right approach, dependingbased on your organization's scale, complexity, and tooling preferences.
Choose your capability
| Content type | Portal | Content distribution | Repositories | Content Hub | APIs | Terraform |
|---|---|---|---|---|---|---|
| Custom detection rules | Yes | Yes | No | Yes | No | |
| Analytics rules | Yes | Yes | Yes | Yes | Yes | Yes |
| Playbooks | Yes | Yes | Yes | Yes | Yes | Yes |
| Workbooks | Yes | Yes | Yes | Yes | Yes | Yes |
@@ -4,8 +4,9 @@ description: Learn how to choose the right capability for managing detections an author: mberdugo ms.author: monaberdugo ms.topic: concept-article-ms.date: 05/07/2026+ms.date: 08/07/2026 ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1015 appliesto: - Microsoft Sentinel in the Microsoft Defender portal - Microsoft Sentinel in the Azure portal@@ -18,7 +19,7 @@ ms.collection: usx-security # Detection lifecycle management recommendations -This article provides recommendations for managing detections and other content types in Microsoft Sentinel. Use these recommendations to identiy the right approach, depending on your organization's scale, complexity, and tooling preferences.+Choose a Microsoft Sentinel capability for managing detections and other content based on your organization's scale, complexity, and tooling preferences. ## Choose your capability @@ -77,7 +78,7 @@ The following table shows the content types supported by each capability. | Content type | Portal | Content distribution | Repositories | Content Hub | APIs | Terraform | |---|---|---|---|---|---|---|-| Custom detection rules | Yes | Yes | No | No | Yes | No |+| Custom detection rules | Yes | Yes | Yes (Preview) | No | Yes | No | | Analytics rules | Yes | Yes | Yes | Yes | Yes | Yes | | Playbooks | Yes | Yes | Yes | Yes | Yes | Yes | | Workbooks | Yes | Yes | Yes | Yes | Yes | Yes |