Manage Template Versions for your Scheduled Analytics Rules in Microsoft Sentinel

@@ -1,12 +1,12 @@ ----title: Manage template versions for your scheduled analytics rules in Microsoft Sentinel+title: Manage Template Versions for your Scheduled Analytics Rules in Microsoft Sentinel description: Learn how to manage the relationship between your scheduled analytics rule templates and the rules created from those templates. Merge updates to the templates into your rules, and revert changes in your rules back to the original template. ms.author: guywild author: guywi-ms ms.reviewer: noak ms.topic: how-to-ms.date: 06/15/2026-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014+ms.date: 07/02/2026+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016 ai-usage: ai-assisted  #Customer intent: As a security analyst, I want to manage and update analytics rule templates so that I can ensure my threat detection rules are current and effective.@@ -18,11 +18,11 @@ ai-usage: ai-assisted >[!IMPORTANT] > [**Custom detections**](/defender-xdr/custom-detections-overview?toc=/azure/sentinel/TOC.json&bc=/azure/sentinel/breadcrumb/toc.json) is now the best way to create new rules across Microsoft Sentinel SIEM Microsoft Defender XDR. With custom detections, you can reduce ingestion costs, get unlimited real-time detections, and benefit from seamless integration with Defender XDR data, functions, and remediation actions with automatic entity mapping. For more information, read [Custom detections are now the unified experience for creating detections in Microsoft Defender XDR](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/custom-detections-are-now-the-unified-experience-for-creating-detections-in-micr/4463875). +This article explains how to track template version changes for your scheduled analytics rules in Microsoft Sentinel, update your rules to match new template versions, and revert rules back to their original templates.+ > [!IMPORTANT] > Managing analytics rule template versions is in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability. -This article explains how to track template version changes for your scheduled analytics rules in Microsoft Sentinel, update your rules to match new template versions, and revert rules back to their original templates.- <a name="introduction"></a> ## How template version management works @@ -56,7 +56,7 @@ With the implementation of template version control, you can see and track the v      :::image type="content" source="media/manage-analytics-rule-templates/see-template-versions.png" alt-text="Screenshot of details pane. Scroll down to see template version numbers." border="false"::: -    The number is in a "1.0.0" format – major version, minor version, and build.  +    Each version number is in a "1.0.0" format – major version, minor version, and build.        - A difference in the *major version* number indicates that something essential in the template was changed, that could affect how the rule detects threats or even its ability to function altogether. You want to include this change in your rules. @@ -80,7 +80,7 @@ Any automation step or logic that refers to the existing rule should be verified  Having selected a rule and determined that you want to consider updating it, select **Review and update** in the rule details pane. You see that the **Analytics rule wizard** now has a **Compare to latest version** tab. -On this tab, you see a side-by-side comparison between the YAML representations of the existing rule and the latest version of the template. +On the **Compare to latest version** tab, you see a side-by-side comparison between the YAML representations of the existing rule and the latest version of the template.   :::image type="content" source="media/manage-analytics-rule-templates/compare-template-versions.png" alt-text="Screenshot of 'Compare to latest version' tab in Analytics rule wizard."::: @@ -88,7 +88,7 @@ On this tab, you see a side-by-side comparison between the YAML representations  Choose one of the following actions to apply, customize, or cancel the template update: -- If the changes made to the new version of the template are acceptable to you, and nothing else in your original rule is affected, select **Review and update** to validate and apply the changes. +- If the changes made to the new version of the template are acceptable to you, and nothing else in your original rule is affected, select **Review and update** to validate and apply the changes.  - If you want to further customize the rule or reapply any changes that might otherwise be overwritten, select **Next : Custom changes**. Cycle through the remaining tabs of the [Analytics rule wizard](create-analytics-rules.md) to make those changes, then validate and apply the changes on the **Review and update** tab. @@ -97,13 +97,13 @@ Choose one of the following actions to apply, customize, or cancel the template ## [Revert to template](#tab/revert)  > [!NOTE]-> Updating this rule will overwrite your existing rule with the latest version of the template.+> Updating this rule overwrites your existing rule with the latest version of the template. -Any automation step or logic that refers to the existing rule should be verified, in case the referenced names changed. Also, any customizations you made in creating the original rule&mdash;changes to the query, scheduling, grouping, or other settings&mdash;might be overwritten.+Any automation step or logic that refers to the existing rule should be verified, in case the referenced names changed. Also, any customizations you made in creating the original rule, including changes to the query, scheduling, grouping, or other settings, might be overwritten.  Having selected a rule and determined that you want to revert to its original version, select **Compare with template** in the rule details pane. You see that the **Analytics rule wizard** now has a **Compare to latest version** tab. -On this tab, you see a side-by-side comparison between the YAML representations of the existing rule and the latest version of the template. These two version numbers might be the same, but the right side shows the original, unchanged template, and the left side shows the active rule, including any changes from the original template.+On the **Compare to latest version** tab, you see a side-by-side comparison between the YAML representations of the existing rule and the latest version of the template. These two version numbers might be the same, but the right side shows the original, unchanged template, and the left side shows the active rule, including any changes from the original template.  :::image type="content" source="media/manage-analytics-rule-templates/compare-template-versions-2.png" alt-text="Screenshot of 'Compare to latest version' tab in Analytics rule wizard."::: @@ -111,7 +111,7 @@ On this tab, you see a side-by-side comparison between the YAML representations  Use one of the following options to revert the rule, make additional changes, or cancel the operation: -- If you want to revert completely to the original version of this rule&mdash;a clean copy of the template&mdash;select **Review and update** to validate and apply the changes. +- If you want to revert completely to the original version of this rule&mdash;a clean copy of the template&mdash;select **Review and update** to validate and apply the changes.  - If you want to customize the rule differently or reapply any changes that might otherwise be overwritten, select **Next : Custom changes**. Cycle through the remaining tabs of the [Analytics rule wizard](create-analytics-rules.md) to make those changes, then validate and apply the changes on the **Review and update** tab. @@ -119,8 +119,7 @@ Use one of the following options to revert the rule, make additional changes, or  --- -## Next steps-In this document, you learned how to track the versions of your Microsoft Sentinel analytics rule templates, and either to revert active rules to existing template versions, or update them to new ones. To learn more about Microsoft Sentinel, see the following articles:+## Related content -- Learn more about [analytics rules](threat-detection.md).-- See more details about the [analytics rule wizard](create-analytics-rules.md).+- [Threat detection in Microsoft Sentinel](threat-detection.md).+- [Create a scheduled analytics rule from scratch](create-analytics-rules.md).