Microsoft Sentinel
Cloud and workloadsWork With Anomaly Rules
In brief
The anomaly comparison step now links more clearly to the quality assessment guidance, and the anomaly detection resources heading was revised. Page metadata was also updated.
What Defender admins need to know
No administrator action is required; the revised wording may make the comparison procedure easier to follow.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
#Customer intent: As a security analyst, I want to customize and tune anomaly detection rules so that I can improve the accuracy and relevance of alerts in my environment.
Enable the customized rule to generate results. Some of your changes may require the rule to run again, so you must wait for it to finish and come back to check the results on the logs page. The customized anomaly rule runs in Flighting (testing) mode by default. The original rule continues to run in Production mode by default.
To compare the results, go back to the Anomalies table in Logs to assess the new rule as described earlier in Assess the quality of anomalies,
onlybut use the following query instead to look for anomalies generated by the original rule as well as the duplicate rule.Anomalies
Next steps
ForLearn more information about anomaly detection in Microsoft Sentinel, see the following resources:Sentinel:
- Get some background information about customizable anomalies.
- View the available anomaly types in Microsoft Sentinel.
@@ -5,13 +5,13 @@ ms.author: guywild author: guywi-ms ms.reviewer: noak ms.topic: how-to-ms.date: 06/15/2026+ms.date: 07/02/2026 appliesto: - Microsoft Sentinel in the Microsoft Defender portal - Microsoft Sentinel in the Azure portal ms.collection: usx-security ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 #Customer intent: As a security analyst, I want to customize and tune anomaly detection rules so that I can improve the accuracy and relevance of alerts in my environment.@@ -135,7 +135,7 @@ The original anomaly rule will keep running until you either disable or delete i 1. Enable the customized rule to generate results. Some of your changes may require the rule to run again, so you must wait for it to finish and come back to check the results on the logs page. The customized anomaly rule runs in **Flighting** (testing) mode by default. The original rule continues to run in **Production** mode by default. -1. To compare the results, go back to the Anomalies table in **Logs** to [assess the new rule as before](#assess-the-quality-of-anomalies), only use the following query instead to look for anomalies generated by the original rule as well as the duplicate rule.+1. To compare the results, go back to the Anomalies table in **Logs** to assess the new rule as described earlier in [Assess the quality of anomalies](#assess-the-quality-of-anomalies), but use the following query instead to look for anomalies generated by the original rule as well as the duplicate rule. ```kusto Anomalies @@ -147,7 +147,7 @@ If you are satisfied with the results for the customized rule, you can go back t ## Next steps -For more information about anomaly detection in Microsoft Sentinel, see the following resources:+Learn more about anomaly detection in Microsoft Sentinel: - Get some background information about [customizable anomalies](soc-ml-anomalies.md). - View the [available anomaly types](anomalies-reference.md) in Microsoft Sentinel.