Microsoft Defender XDR

Manage custom detection rules in Microsoft Defender XDR

4 September 2026Doc update+8 / −5 lines

In brief

The article now explicitly covers viewing, editing, running, enabling, disabling, and deleting custom detection rules, along with reviewing triggered alerts and response actions. Headings, an anchor, and the publication date were also updated.

What Defender admins need to know

Administrators have clearer documentation for managing custom detection rules in Microsoft Defender XDR; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

[!INCLUDE Microsoft Defender XDR rebranding]

This article explains how to view, edit, run, enable, disable, and delete custom detection rules built from advanced hunting queries in Microsoft Defender XDR. You can also review triggered alerts and response actions for each rule.

ManageAvailable management actions for custom detection rules

You can view the list of existing custom detection rules, check their previous runs, and review the alerts that were triggered. You can also run a rule on demand, modify it, or create a new custom detection rule directly from the list.

Delete - turns off the rule and permanently removes it
Include or exclude from correlation - allows you to include or exclude an analytics rule from correlation. See Manage analytics rule correlation settings in Microsoft Defender XDR for more information.

View and manage triggered alerts

In the rule details screen (Hunting > Custom detections > [Rule name]), go to Triggered alerts, which lists the alerts generated by matches to the rule. Select an alert to view detailed information about it and take the following actions:

Link the alert to an incident
Run the query that triggered the alert on advanced hunting

Review actions

In the rule details screen (Hunting > Custom detections > [Rule name]), go to Triggered actions, which lists the actions taken based on matches to the rule.

@@ -1,6 +1,6 @@ --- title: Manage custom detection rules in Microsoft Defender XDR-description: Learn how to manage custom detections rules based on advanced hunting queries.+description: Manage custom detection rules built from advanced hunting queries, including viewing, editing, running, enabling, and disabling rules in Microsoft Defender XDR. ms.service: defender-xdr ms.subservice: adv-hunting ms.author: pauloliveria@@ -18,7 +18,7 @@ appliesto:     - Microsoft Defender XDR     - Microsoft Sentinel in the Microsoft Defender portal ms.topic: how-to-ms.date: 06/16/2026+ms.date: 07/02/2026 ai-usage: ai-assisted --- @@ -26,7 +26,10 @@ ai-usage: ai-assisted  [!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)] -## Manage custom detection rules+This article explains how to view, edit, run, enable, disable, and delete custom detection rules built from advanced hunting queries in Microsoft Defender XDR. You can also review triggered alerts and response actions for each rule.++<a name="manage-custom-detection-rules"></a>+## Available management actions for custom detection rules  You can view the list of existing custom detection rules, check their previous runs, and review the alerts that were triggered. You can also run a rule on demand, modify it, or create a new custom detection rule directly from the list. @@ -72,7 +75,7 @@ You can also take the following actions on the rule from the rule details page: - **Delete** - turns off the rule and permanently removes it - **Include or exclude from correlation** - allows you to include or exclude an analytics rule from correlation. See [Manage analytics rule correlation settings in Microsoft Defender XDR](exclude-analytics-rules-correlation.md) for more information. -#### View and manage triggered alerts +### View and manage triggered alerts   In the rule details screen (**Hunting** \> **Custom detections** \> **[Rule name]**), go to  **Triggered alerts**, which lists the alerts generated by matches to the rule. Select an alert to view detailed information about it and take the following actions: @@ -80,7 +83,7 @@ In the rule details screen (**Hunting** \> **Custom detections** \> **[Rule name - Link the alert to an incident - Run the query that triggered the alert on advanced hunting -#### Review actions+### Review actions  In the rule details screen (**Hunting** \> **Custom detections** \> **[Rule name]**), go to **Triggered actions**, which lists the actions taken based on matches to the rule.