Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
Hunting and detection

Custom Detection Rules

4 October 2026Feature update+30 / −23 lines

In brief

Custom frequency from 5 minutes to 14 days is available only for rules based exclusively on Microsoft Sentinel data. Rules using Defender XDR data now use fixed lookback periods based on their run frequency, ranging from 4 hours to 30 days.

What Defender admins need to know

When creating custom detections, verify the data source and expected lookback coverage; Defender XDR data cannot use custom scoping with this frequency option.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • m365initiative-m365-defender
  • tier2 ms.custom:
  • msecd-doc-authoring-10301014
  • sfi-ga-nochange
  • cx-ti
  • cx-ah
  • sfi-image-nochange ms.topic: how-to ms.date: 2026-10-04T00:09-02T00:00:00.0000000Z ai-usage: ai-assisted locale: en-us document_id: 889233db-f43a-794c-5a31-24ee96a226be

Tip

For better query performance, set a time filter that matches the configured lookback periodyour intended run frequency for the rule. Since the least frequent run is every 24 hours, filtering for the past day covers all new data.

Custom column for Microsoft Sentinel scoping

In the query editor, select Create detection rule and specify the following alert details:

  • Detection name - Name of the detection rule; make it unique.
  • Frequency - Interval for running the query and taking action. Custom frequency for all supported data sources is in public preview and supports intervals from 5 minutes to 14 days. For more information, see Rule frequency.
  • Lookback - Amount of historical data thatThe time period covered by the query evaluates each time it runs. Configurable lookback for all supportedwhen the custom detection targets data sources is in public preview and supports periods from 5 minutes to 30 days.Microsoft Sentinel only. For more information, see Custom frequency and lookback.Lookback.
  • Alert title - Title displayed with alerts triggered by the rule; make it unique and use plaintext. Strings are sanitized for security purposes, so HTML, Markdown, and other code don't work. Any URLs included in the title should follow the percent-encoding format for them to display properly.
  • Severity - Potential risk of the component or activity identified by the rule.
  • Category - Threat component or activity identified by the rule.

Rule frequency

When you save a new rule, it runs and checks for matches from the past 30 days of data. The rule then runs again at fixed intervals, applying a lookback period based on the configured interval:frequency you choose:

  • Every 24 hours
  • Every 12 hours
  • Every 3 hours
  • Every hour
  • Continuous (NRT) - Runs continuously, checking data from events as they're collected and processed in near real-time (NRT). For more information, see Continuous (NRT) frequency.
  • Custom (public preview) - Runs at an intervalaccording to the frequency you selected. This option is available if the rule is based only on data that you configure, from 5 minutesis ingested to 14 days.Microsoft Sentinel. For more information, see Custom frequency and lookback.for Microsoft Sentinel data.

Tip

Only generally available columns support Continuous (NRT) frequency.

Custom frequency and lookback (public preview)
for Microsoft Sentinel data

Flexible frequency and lookback for custom detections are in public preview. You can configure these settings independently for rules that use any supported data source, includingMicrosoft Sentinel customers who onboard to Microsoft Defender XDR andcan select Custom frequency when the rule is based only on data that Microsoft Sentinel data.ingests.

Use these settings to:

  • When you select this frequency option, the Run aquery every input component appears. Type the desired frequency for the rule as frequently as every 5 minutes.
  • Setand use the frequencydropdown to select the units: minutes, hours, or days. The supported range is any value from 5 minutes to 14 days.

    Screenshot that shows the Custom frequency option in the Custom detections setup guide.

    Important

    When you select a custom frequency, Defender fetches your data from Microsoft Sentinel. This condition means that:

    1. You must have data available in Microsoft Sentinel.
    2. Set theDefender data doesn't support scoping, since Microsoft Sentinel doesn't support scoping.

    Lookback

    The lookback period of your custom detections can range from 5five minutes to 30 days.days, depending on the target data and frequency of your query.

    If your custom detections include Defender XDR data, a fixed lookback period is applied depending on the rule frequency that you choose:

    • For detections set to run every 24 hours, the lookback period is 30 days.
    • Use a longerFor detections set to run every 12 hours, the lookback while keepingperiod is 48 hours.
    • For detections set to run every three hours, the frequency needed for time-sensitive detections.lookback period is 12 hours.
    • For detections set to run hourly, the lookback period is four hours.

    To configure the schedule, select Custom frequency. In Run query every, enter the frequency, and then select minutes, hours, or days. In LookupIf your custom detections target Microsoft Sentinel data from the last, configureonly, you can customize the lookback period.period depending on the rule frequency that you set:

    Screenshot that shows the Custom frequency option in the custom detection rule wizard.

    The

    • For detections set to run in frequencies higher (more frequent) than one hour, the lookback must be at least as long as the frequencyperiod is limited to avoid coverage gaps. The frequency also determines the maximum supported lookback:

      FrequencySupported lookback
      5 minutes to less than 1 hourAt least the selected frequency and less than 48 hours
      1 hour.
    • For detections set to lessrun in frequencies higher than 1one day
      		• At least, the selected frequency and lookback can be set up to 14 days
      1.
    • For detections set to run in frequencies of one day to 14 days
      		• At leastor less, the selected frequency and lookback can be set up to 30 days

      Rules that run more frequently have shorter maximum lookback periods to maintain performance.

      .

    Important