Microsoft Defender XDR
Hunting and detectionCustom Detection Manage
In brief
The documentation now states that custom detections are included in correlation by default and have a per-rule option to include or exclude them.
What Defender admins need to know
Administrators can use the per-rule correlation setting when managing custom detections; no required action is stated.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- m365initiative-m365-defender
- tier2 ms.custom:
- msecd-doc-authoring-
10141030 - cx-ti
- cx-ah
ms.topic: how-to
ms.date: 2026-
07-02T00:10-04T00:00:00.0000000Z ai-usage: ai-assisted locale: en-us document_id: 76dfe3e6-2253-8172-d91e-df741bf40f4f - Modify query - opens the query directly in advanced hunting for editing
- Turn on / Turn off - allows you to enable the rule or stop it from running
- Delete - turns off the rule and permanently removes it
- Include or exclude from correlation - allows you to include or exclude an analytics rule from correlation. For custom detections, this per-rule setting is in public preview. Custom detections are included in correlation by default. See Manage detection rule correlation settings in Microsoft Defender XDR for more information.
View and manage triggered alerts
@@ -19,11 +19,11 @@ ms.collection: - m365initiative-m365-defender - tier2 ms.custom:-- msecd-doc-authoring-1014+- msecd-doc-authoring-1030 - cx-ti - cx-ah ms.topic: how-to-ms.date: 2026-07-02T00:00:00.0000000Z+ms.date: 2026-10-04T00:00:00.0000000Z ai-usage: ai-assisted locale: en-us document_id: 76dfe3e6-2253-8172-d91e-df741bf40f4f@@ -98,7 +98,7 @@ You can also take the following actions on the rule from the rule details page: - **Modify query** - opens the query directly in advanced hunting for editing
- **Turn on** / **Turn off** - allows you to enable the rule or stop it from running
- **Delete** - turns off the rule and permanently removes it
-- **Include or exclude from correlation** - allows you to include or exclude an analytics rule from correlation. See [Manage analytics rule correlation settings in Microsoft Defender XDR](exclude-analytics-rules-correlation) for more information.
+- **Include or exclude from correlation** - allows you to include or exclude an analytics rule from correlation. For custom detections, this per-rule setting is in public preview. Custom detections are included in correlation by default. See [Manage detection rule correlation settings in Microsoft Defender XDR](exclude-analytics-rules-correlation) for more information.
### View and manage triggered alerts