Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Migrate ArcSight Detection Rules to Microsoft Sentinel

4 September 2026Doc update+41 / −33 lines

In brief

The article was revised with updated metadata and wording, including references to the six-to-12-month rule review window, built-in templates, ArcSight-to-KQL mapping, playbooks, and related resources.

What Defender admins need to know

Administrators following the migration guide can use the updated wording and links to navigate rule conversion and related tasks.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Migrate ArcSight detection rulesDetection Rules to Microsoft Sentinel description: Identify, compare, and migrate your ArcSight detection rules to Microsoft Sentinel analytics rules. author: EdB-MSFT ms.author: edbaynash ms.topic: how-to ms.date: 06/15/07/01/2026 ms.custom: sfi-image-nochange, msecd-doc-authoring-10141016 ai-usage: ai-assisted

Microsoft Sentinel uses machine learning analytics to create high-fidelity and actionable incidents, and some of your existing detections may be redundant in Microsoft Sentinel. Therefore, don't migrate all of your detection and analytics rules blindly. Review the following considerations as you identify your existing detection rules.

  • Make sure to select use cases that justify rule migration, considering business priority and efficiency.
  • Check that you understand Microsoft Sentinel rule types.
  • Check that you understand the rule terminology.
  • Review any rules that haven't triggered any alerts in the past 6-six to 12 months, and determine whether they're still relevant.
  • Eliminate low-level threats or alerts that you routinely ignore.
  • Use existing functionality, and check whether Microsoft Sentinel’s built-in analytics rules might address your current use cases. Because Microsoft Sentinel uses machine learning analytics to produce high-fidelity and actionable incidents, it’s likely that some of your existing detections won’t be required anymore.
  • Confirm connected data sources and review your data connection methods. Revisit data collection conversations to ensure data depth and breadth across the use cases you plan to detect.
  • Explore community resources such as the SOC Prime Threat Detection Marketplace to check whether your rules are available.
  • Consider whether an online query converter such as Uncoder.io might work for your rules.
  • If rules aren’t available or can’t be converted, they need to be created manually, using a KQL query. Review the rules mapping to create new queries.

Learn more about best practices for migrating detection rules.

    In Microsoft Sentinel, go to the **Configuration > Analytics > Rule templates** tab, and create and update each relevant analytics rule.

    For more information,To learn how to create rules from built-in templates, see [Create scheduled analytics rules from templates](create-analytics-rule-from-template.md).

- **If you have detections that aren't covered by Microsoft Sentinel's built-in rules**, try an online query converter, such as [Uncoder.io](https://uncoder.io/) to convert your queries to KQL.


    1. **Identify your rule criteria and logic**. At this stage, you may want to use rule templates as samples for how to construct your KQL queries.

        Consider filters, correlation rules, active lists, reference sets, watchlists, detection anomalies, aggregations, and so on. You might use references provided by your legacy SIEM to understand [how[map ArcSight query syntax to best map your query syntax]KQL](#map-and-compare-rule-samples).

    1. **Identify the trigger condition and rule action, and then construct and review your KQL query**. When reviewing your query, consider KQL optimization guidance resources.

  1. Test the rule with each of your relevant use cases. If it doesn't provide expected results, you may want to review the KQL and test it again.

  2. When you're satisfied, you can consider the rule migrated. Create a playbook for your rule action as needed. For more information,To create and use playbooks for rule actions, see Automate threat response with playbooks in Microsoft Sentinel.

Learn more about analytics rules:

Compare rule terminology

ArcSight Microsoft Sentinel
Rule type •- Filter rule
•- Join rule
•- Active list rule
•- And more		 •- Scheduled query
•- Fusion
•- Microsoft Security
•- Machine Learning (ML) Behavior Analytics
Criteria Define in rule conditions Define in KQL
Trigger condition •- Define in action
•- Define in aggregation (for event aggregation)		 Threshold: Number of query results
Action •- Set event field
•- Send notification
•- Create new case
•- Add to active list
•- And more		 •- Create alert or incident
•- Integrates with Logic Apps

Map and compare rule samples

Use the following samples to compare and mapArcSight detection rules from ArcSight towith equivalent Microsoft Sentinel queries written in various scenarios.Kusto Query Language (KQL).

Rule Description Sample detection rule (ArcSight) Sample KQL query Resources
Filter (AND) A sample rule with AND conditions. The event must match all conditions. Filter (AND) example Filter (AND) example String filter:
•- String operators

Numerical filter:
•- Numerical operators

Datetime filter:
•- ago
•- Datetime
•- between
•- now

Parsing:
•- parse
•- extract
•- parse_json
•- parse_csv
•- parse_path
•- parse_url
Filter (OR) A sample rule with OR conditions. The event can match any of the conditions. Filter (OR) example Filter (OR) example •- String operators
•- in
Nested filter A sample rule with nested filtering conditions. The rule includes the MatchesFilter statement, which also includes filtering conditions. Nested filter example Nested filter example •- Use KQL functions to speed up analysis
•- Enrich Windows security events with a parameterized function
•- join
•- where
Active list (lookup) A sample lookup rule that uses the InActiveList statement. Active list (lookup) example Active list (lookup) example •- A watchlist is the equivalent of the active list feature. Learn more about watchlists.
•- Other ways to implement lookups
Correlation (matching) A sample rule that defines a condition against a set of base events, using the Matching Event statement. Correlation (matching) example Correlation (matching) example join operator:
•- join
•- join with time window
•- shuffle
•- Broadcast
•- Union

define statement:
•- let

Aggregation:
•- make_set
•- make_list
•- make_bag
•- bag_pack
Correlation (time window) A sample rule that defines a condition against a set of base events, using the Matching Event statement, and uses the Wait time filter condition. Correlation (time window) example Correlation (time window) example •- join
•- Microsoft Sentinel rules and join statement

Filter (AND) example: ArcSight

isnotempty(TargetDomainName) | where SubjectUserName !~ "AutoMatedService" 

As a second option, use a KQL function:

1. Save the following query as a KQL function with the `ExcludeValidUsers` alias.

    ```kusto
        SecurityEvent
        | where EventID == 4728
As a third option, use a parameter function:

1. Create a parameter function with `ExcludeValidUsers` as the name and alias.
2.1. Define the parameters of the function. For example:

    ```kusto
        Tbl: (TimeGenerated:datetime, Computer:string,
    ```

1. The `parameter` function has the following query:

    ```kusto
        Tbl
        | where SubjectUserName !~ "AutoMatedService"
| join kind=leftanti ExcludeValidUsers on
$left.SubjectUserName == $right.SubjectUserName

Considerations:

Considerations

  • We recommend that you use a direct filter with a where statement (first option) due to its simplicity. For optimized performance, avoid using join (fourth option).
  • To optimize your queries, avoid the =~ and !~ case-insensitive operators when possible. Use the == and != operators if the value isn't case-sensitive.

Active list (lookup) example: KQL

This rule assumes that the Cyber-Ark Exception Accounts watchlist exists in Microsoft Sentinel with an Account field.

let Activelist=(
TimeGenerated,SourceHostName,
SourceUserName, DeviceEventClassID

Order the filters by starting with the where statement that filters out the most data.

Correlation (matching) example: ArcSight

| join kind=inner event2 on $left.TargetUserName==$right.TargetUserName

Best practices:
- To optimize your query, ensure that the smaller table is on the left side of the `join` function.
- If the left side of the table is relatively small (up to 100 K records), add `hint.strategy=broadcast` for better performance.

 AccountUsedToRemove,event1_Host,event2_Host,
 event1_UPN,event2_UPN

Aggregation example: ArcSight

Here's a sample ArcSight rule with aggregation settings: three matches within 10 minutes. | where Count >3


## Next steps

In this article, you learned how to map your migration rules from ArcSight to Microsoft Sentinel.

> [!div class="nextstepaction"]
> [Migrate your SOAR automation](migration-arcsight-automation.md)

The following KQL query uses the Cyber-Ark Exception Accounts watchlist to filter lookup results. 

let Activelist=(
TimeGenerated,SourceHostName,
SourceUserName, DeviceEventClassID

Order the filters by starting with the where statement that filters out the most data.

Correlation (matching) example: ArcSight

| join kind=inner event2 on $left.TargetUserName==$right.TargetUserName 


#### Best practices

- To optimize your query, ensure that the smaller table is on the left side of the `join` function.
- If the left side of the table is relatively small (up to 100 K records), add `hint.strategy=broadcast` for better performance.

 AccountUsedToRemove,event1_Host,event2_Host,
 event1_UPN,event2_UPN

Aggregation example: ArcSight

Here's a sample ArcSight rule with aggregation settings: three matches within 10 minutes. | where Count >3


## Next step

> [!div class="nextstepaction"]
> [Migrate your SOAR automation](migration-arcsight-automation.md)