Microsoft Sentinel
Cloud and workloadsSurface Custom Details In Alerts
In brief
The article now uses the labels “Microsoft Defender portal” and “Microsoft Azure portal,” and its publication date and authoring metadata were updated.
What Defender admins need to know
Administrators can use the clearer portal labels when following the article; no action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
#Customer intent: As a security analyst, I want to surface custom event details in alerts so that I can triage, investigate, and respond to incidents more efficiently.
Enter the Analytics page in the portal through which you access Microsoft Sentinel:
Microsoft Defender portal
From the Microsoft Defender navigation menu, expand Microsoft Sentinel, then Configuration. Select Analytics.
Microsoft Azure portal
From the Configuration section of the Microsoft Sentinel navigation menu, select Analytics.
@@ -5,13 +5,13 @@ ms.author: guywild author: guywi-ms ms.reviewer: idpelleg ms.topic: how-to-ms.date: 06/15/2026+ms.date: 07/02/2026 appliesto: - Microsoft Sentinel in the Microsoft Defender portal - Microsoft Sentinel in the Azure portal ms.collection: usx-security ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 #Customer intent: As a security analyst, I want to surface custom event details in alerts so that I can triage, investigate, and respond to incidents more efficiently.@@ -34,11 +34,11 @@ Perform the following steps to surface custom event details in an analytics rule 1. Enter the **Analytics** page in the portal through which you access Microsoft Sentinel: - # [Defender portal](#tab/defender)+ # [Microsoft Defender portal](#tab/defender) From the Microsoft Defender navigation menu, expand **Microsoft Sentinel**, then **Configuration**. Select **Analytics**. - # [Azure portal](#tab/azure)+ # [Microsoft Azure portal](#tab/azure) From the **Configuration** section of the Microsoft Sentinel navigation menu, select **Analytics**.