Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Migrate QRadar Detection Rules to Microsoft Sentinel

4 September 2026Doc update+96 / −70 lines

In brief

The article now provides more detail on inventorying and comparing QRadar detections, selecting migration paths, and understanding Microsoft Sentinel rule types, including Fusion. It also updates formatting, links, metadata, and examples.

What Defender admins need to know

Administrators have clearer guidance for planning and mapping QRadar detection-rule migrations; no required action is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Migrate QRadar detection rulesDetection Rules to Microsoft Sentinel description: Learn how to inventory QRadar detection rules, map them to Microsoft Sentinel analytics rule types, and plan your migration using built-in detections or custom KQL queries. author: EdB-MSFT ms.author: edbaynash ms.topic: how-to ms.date: 06/15/07/01/2026 ms.custom: sfi-image-nochange, msecd-doc-authoring-10141016 ai-usage: ai-assisted

#Customer intent: As a security engineer, I want to migrate QRadar detection rules to Microsoft Sentinel so that analysts can leverage machine learning analytics for more efficient threat detection and incident response.

Migrate QRadar detection rules to Microsoft Sentinel

This article describes how to identify, compare, and migrate your QRadar detection rules to Microsoft Sentinel built-in rules. It walks you through inventorying your existing detections, comparing rule terminology between QRadar and Microsoft Sentinel, and choosing the right migration path—whether that's adopting built-in analytics templates from the Content Hub, converting queries with an online tool, or writing custom Kusto Query Language (KQL) queries. By the end, you'll have a structured approach for migrating your detection rules while taking advantage of Microsoft Sentinel's machine learning analytics.

Identify and migrate rules

Microsoft Sentinel uses machine learning analytics to create high-fidelity and actionable incidents, and some of your existing detections may be redundant in Microsoft Sentinel. Therefore, don't migrate all of your detection and analytics rules blindly. Review these considerations as you identify your existing detection rules.

  • Make sure to select use cases that justify rule migration, considering business priority and efficiency.
  • Check that you understand Microsoft Sentinel rule types.
  • Check that you understand the rule terminology.
  • Review any rules that haven't triggered any alerts in the past 6-12 months, and determine whether they're still relevant.
  • Eliminate low-level threats or alerts that you routinely ignore.
  • Use existing functionality and check whether Microsoft Sentinel’s built-in analytics rules might address your current use cases. Because Microsoft Sentinel uses machine learning analytics to produce high-fidelity and actionable incidents, it’s likely that some of your existing detections won’t be required anymore.
  • Confirm connected data sources and review your data connection methods. Revisit data collection conversations to ensure data depth and breadth across the use cases you plan to detect.
  • Explore community resources such as the SOC Prime Threat Detection Marketplace to check whether your rules are available.
  • Consider whether an online query converter such as Uncoder.io might work for your rules.
  • If rules aren't available or can't be converted, they need to be created manually, using a KQL query. Review the rules mapping to create new queries.

Learn more about best practices for migrating detection rules. 

    1. **Identify your rule criteria and logic**. At this stage, you may want to use rule templates as samples for how to construct your KQL queries as samples for how to construct your KQL queries.

        Consider filters, correlation rules, active lists, reference sets, watchlists, detection anomalies, aggregations, and so on. You might use references provided by your legacy SIEM to understand [how to best map your query syntax](#map-and-compare-rule-samples).

    1. **Identify the trigger condition and rule action, and then construct and review your KQL query**. When reviewing your query, consider KQL optimization guidance resources.

For more information about Microsoft Sentinel analytics rules and KQL, see the following resources:

Compare rule terminology

This table helps you to clarify the concept of a rule in Microsoft Sentinel compared to QRadar. Microsoft Sentinel rule types include scheduled queries, Fusion,Fusion (which automatically correlates alerts from multiple data sources into incidents using machine learning), Microsoft Security, and Machine Learning (ML) Behavior Analytics.

QRadar Microsoft Sentinel
Rule type •- Events
•- Flow
•- Common
•- Offense
•- Anomaly detection rules		 •- Scheduled query
•- Fusion
•- Microsoft Security
•- Machine Learning (ML) Behavior Analytics
Criteria Define in test condition Define in KQL
Trigger condition Define in rule Threshold: Number of query results
Action •- Create offense
•- Dispatch new event
•- Add to reference set or data
•- And more		 •- Create alert or incident
•- Integrates with Logic Apps

Map and compare rule samples

Use these samples to compare and map rules from QRadar to Microsoft Sentinel in various scenarios. The sample queries are written in Kusto Query Language (KQL), the query language used by Microsoft Sentinel.

Rule Syntax Sample detection rule (QRadar) Sample KQL query Resources
Common property tests QRadar syntax •- Regular expression example
•- AQL filter query example
•- equals/not equals example		 •- Regular expression example
•- AQL filter query example
•- equals/not equals example		 •- Regular expression: matches regex
•- AQL filter query: string operators
•- equals/not equals: String operators
Date/time tests QRadar syntax •- Selected day of the month example
•- Selected day of the week example
•- after/before/at example		 •- Selected day of the month example
•- Selected day of the week example
•- after/before/at example		 •- Date and time operators
•- Selected day of the month: dayofmonth()
•- Selected day of the week: dayofweek()
•- after/before/at: format_datetime()
Event property tests QRadar syntax •- IP protocol example
•- Event Payload string example
 •- IP protocol example
•- Event Payload string example
 •- IP protocol: String operators
•- Event Payload string: has
Functions: counters QRadar syntax Event property and time example Event property and time example summarize
Functions: negative conditions QRadar syntax Negative conditions example Negative conditions example •- join()
•- String operators
•- Numerical operators
Functions: simple QRadar syntax Simple conditions example Simple conditions example or
IP/port tests QRadar syntax •- Source port example
•- Source IP example		 •- Source port example
•- Source IP example
Log source tests QRadar syntax Log source example Log source example

Common property tests syntax

Common property tests: Regular expression example (QRadar)

Here's the syntax for a sample QRadar common property tests rule that uses a regular expression: 

when any of <these properties> match <this regular expression>

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-1-sample.png" alt-text="Diagram illustrating a common property test rule that uses a regular expression.":::

CommonSecurityLog | where tostring(SourcePort) matches regex @"\d{1,5}" or tostring(DestinationPort) matches regex @"\d{1,5}" 

### Common property tests: AQL filter query example (QRadar)

Here's the syntax for a sample QRadar common property tests rule that uses an AQL filter query.query:

when the event matches AQL filter query 

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-1-sample-aql.png" alt-text="Diagram illustrating a common property test rule that uses an A Q L filter query.":::

### Common property tests: AQL filter query example (KQL)

Here's the common property tests rule with an AQL filter query in KQL.KQL:

```kusto
CommonSecurityLog
| where SourceIP == '10.1.1.10'

Common property tests: equals/not equals example (QRadar)

Here's the syntax for a sample QRadar common property tests rule that uses the equals or not equals operator. operator: 

and when <this property> <equals/not equals> <this property>

Here's the sample rule in QRadar.

::QRadar: :::image type="content" source="media/migration-qradar-detection-rules/rule-1-sample-equals.png" alt-text="Diagram illustrating a common property test rule that uses equals/not equals.":::

Common property tests: equals/not equals example (KQL)

Here's the common property tests rule with the equals or not equals operator in KQL.KQL: 

CommonSecurityLog
| where SourceIP == DestinationIP

Date/time tests syntax

Here's the QRadar syntax for a date/time tests rule.rule:

:::image type="content" source="media/migration-qradar-detection-rules/rule-2-syntax.png" alt-text="Diagram illustrating a date/time tests rule syntax.":::

Date/time tests: Selected day of the month example (QRadar)

Here's the syntax for a sample QRadar date/time tests rule that uses a selected day of the month. month: 

and when the event(s) occur <on/after/before> the <selected> day of the month

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-2-sample-selected-day.png" alt-text="Diagram illustrating a date/time tests rule that uses a selected day.":::

Date/time tests: Selected day of the month example (KQL)

Here's the date/time tests rule with a selected day of the month in KQL. KQL: 

SecurityEvent
 | where dayofmonth(TimeGenerated) < 4

Date/time tests: Selected day of the week example (QRadar)

Here's the syntax for a sample QRadar date/time tests rule that uses a selected day of the week: 

and when the event(s) occur on any of <these days of the week{Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday}>

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-2-sample-selected-day-week.png" alt-text="Diagram illustrating a date/time tests rule that uses a selected day of the week.":::

Date/time tests: Selected day of the week example (KQL)

Here's the date/time tests rule with a selected day of the week in KQL. KQL: 

SecurityEvent
 | where dayofweek(TimeGenerated) between (3d .. 5d)

Date/time tests: after/before/at example (QRadar)

Here's the syntax for a sample QRadar date/time tests rule that uses the after, before, or at operator. operator: 

and when the event(s) occur <after/before/at> <this time{12.00AM, 12.05AM, ...11.50PM, 11.55PM}>

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-2-sample-after-before-at.png" alt-text="Diagram illustrating a date/time tests rule that uses the after/before/at operator.":::

Date/time tests: after/before/at example (KQL)

Here's the date/time tests rule that uses the after, before, or at operator in KQL. KQL: 

SecurityEvent
| where format_datetime(TimeGenerated,'HH:mm')=="23:55"

TimeGenerated is in UTC/GMT.

Event property tests syntax

Here's the QRadar syntax for an event property tests rule.rule:

:::image type="content" source="media/migration-qradar-detection-rules/rule-3-syntax.png" alt-text="Diagram illustrating an event property tests rule syntax.":::

Event property tests: IP protocol example (QRadar)

Here's the syntax for a sample QRadar event property tests rule that uses an IP protocol. protocol: 

and when the IP protocol is one of the following <protocols>

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-3-sample-protocol.png" alt-text="Diagram illustrating an event property tests rule that uses an I P protocol.":::

Event property tests: IP protocol example (KQL)

Here's the event property tests rule with an IP protocol filter in KQL.KQL: 

CommonSecurityLog
| where Protocol in ("UDP","ICMP")

Event property tests: Event Payload string example (QRadar)

Here's the syntax for a sample QRadar event property tests rule that uses an Event Payload string value. value: 

and when the Event Payload contains <this string>

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-3-sample-payload.png" alt-text="Diagram illustrating an event property tests rule that uses an Event Payload string.":::

Functions: counters syntax

Here's the QRadar syntax for a functions rule that uses counters.counters:

:::image type="content" source="media/migration-qradar-detection-rules/rule-4-syntax.png" alt-text="Diagram illustrating the syntax of a functions rule that uses counters.":::

Counters: Event property and time example (QRadar)

Here's the syntax for a sample QRadar functions rule that uses a defined number of event properties in a defined number of minutes. minutes" 

and when at least <this many> events are seen with the same <event properties> in <this many> <minutes>

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-4-sample-event-property.png" alt-text="Diagram illustrating a functions rule that uses event properties.":::

Counters: Event property and time example (KQL)

Here's the counters rule with event property and time conditions in KQL.KQL: 

CommonSecurityLog
| summarize Count = count() by SourceIP, DestinationIP
| where Count >= 5

Functions: negative conditions syntax

Here's the QRadar syntax for a functions rule that uses negative conditions.conditions:

:::image type="content" source="media/migration-qradar-detection-rules/rule-5-syntax.png" alt-text="Diagram illustrating the syntax of a functions rule that uses negative conditions.":::

Negative conditions example (QRadar)

Here's the syntax for a sample QRadar functions rule that uses negative conditions. conditions: 

and when none of <these rules> match in <this many> <minutes> after <these rules> match with the same <event properties>

Here are two defined rules in QRadar. The negative conditions will beare based on these rules.rules:

:::image type="content" source="media/migration-qradar-detection-rules/rule-5-sample-1.png" alt-text="Diagram illustrating an event property tests rule to be used for a negative conditions rule.":::

:::image type="content" source="media/migration-qradar-detection-rules/rule-5-sample-2.png" alt-text="Diagram illustrating a common property tests rule to be used for a negative conditions rule.":::

Here's a sample of the negative conditions rule based on the two previously defined QRadar rules (Test2 and Test6).:

:::image type="content" source="media/migration-qradar-detection-rules/rule-5-sample-3.png" alt-text="Diagram illustrating a functions rule with negative conditions.":::

Negative conditions example (KQL)

Here's the negative conditions rule with a rightanti join in KQL.KQL: 

let spanoftime = 10m;
Test2
| join kind=rightanti Test6 on $left. SourceIP == $right. SourceIP and $left. Protocol ==$right. Protocol

Functions: simple conditions syntax

Here's the QRadar syntax for a functions rule that uses simple conditions.conditions:

:::image type="content" source="media/migration-qradar-detection-rules/rule-6-syntax.png" alt-text="Diagram illustrating the syntax of a functions rule that uses simple conditions.":::

Simple conditions example (QRadar)

Here's the syntax for a sample QRadar functions rule that uses simple conditions.: 

and when an event matches <any|all> of the following <rules>

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-6-sample-1.png" alt-text="Diagram illustrating a functions rule with simple conditions.":::

Simple conditions example (KQL)

Here's the simple conditions rule in KQL.KQL: 

CommonSecurityLog
| where Protocol !in ("UDP","ICMP") or SourceIP == DestinationIP

IP/port tests syntax

Here's the QRadar syntax for an IP/port tests rule.rule:

:::image type="content" source="media/migration-qradar-detection-rules/rule-7-syntax.png" alt-text="Diagram illustrating the syntax of an IP/port tests rule.":::

IP/port tests: Source port example (QRadar)

Here's the syntax for a sample QRadar rule specifying a source port. port: 

and when the source port is one of the following <ports>

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-7-sample-1-port.png" alt-text="Diagram illustrating a rule that specifies a source port.":::

IP/port tests: Source port example (KQL)

Here's the IP/port tests rule with a source port filter in KQL.KQL: 

CommonSecurityLog
| where SourcePort == 20

IP/port tests: Source IP example (QRadar)

Here's the syntax for a sample QRadar rule specifying a source IP. IP: 

and when the source IP is one of the following <IP addresses>

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-7-sample-2-ip.png" alt-text="Diagram illustrating a rule that specifies a source IP address.":::

IP/port tests: Source IP example (KQL)

Here's the IP/port tests rule with a source IP filter in KQL.KQL: 

CommonSecurityLog
| where SourceIP in ("10.1.1.1","10.2.2.2")

Log source tests syntax

Here's the QRadar syntax for a log source tests rule.rule:

:::image type="content" source="media/migration-qradar-detection-rules/rule-8-syntax.png" alt-text="Diagram illustrating the syntax of a log source tests rule.":::

Log source example (QRadar)

Here's the syntax for a sample QRadar rule specifying log sources. sources: 

and when the event(s) were detected by one or more of these <log source types>

Here's the sample rule in QRadar.QRadar:

:::image type="content" source="media/migration-qradar-detection-rules/rule-8-sample-1.png" alt-text="Diagram illustrating a rule that specifies log sources.":::

Log source example (KQL)

Here's the log source tests rule in KQL.

OfficeActivity
| where OfficeWorkload == "Exchange"

Next stepsstep

In this article, you learned how to map your migration rules from QRadar to Microsoft Sentinel.

[!div class="nextstepaction"] Migrate your SOAR automation \ No newline at end of file