Microsoft Sentinel
Cloud and workloadsCompare Analytics Rules Custom Detections
In brief
The documentation now lists flexible and high-frequency support for Sentinel data. It specifies lookback limits of up to 48 hours for frequencies over one hour and up to 14 days for frequencies of one hour or less; lookback remains in public preview.
What Defender admins need to know
No administrator action is required. Use the documented limits when configuring or reviewing custom detections.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
author: poliveria
ms.reviewer: nonutkev
ms.topic: product-comparison
ms.date: 2026-10-04T00:05-19T00:00:00.0000000Z
ai-usage: ai-assisted
ms.collection: ms-security
ms.custom: msecd-doc-authoring-1030
locale: en-us
document_id: e077c24d-c9ad-2350-c27c-0ca841d756bc
document_version_independent_id: a2c87e85-8daa-bb87-ecbb-87e92b0c29f8
| | Enrich alerts with custom details | Supported | Supported |
| | Define alert title and description dynamically - Integrate query results in runtime | Supported | Supported |
| | Define all alerts properties dynamically - Integrate query results in runtime | Supported | Planned |
| Rule frequency | Flexible ruleSupport flexible and high frequency for Sentinel data | Supported | Supported (public preview)Supported |
| | Near-real-time (NRT) rules on Sentinel data | Supported | Supported |
| | NRT streaming technology - Test events as they stream, not sensitive to ingestion delays | Not supported. Analytics NRT rules test events after they're ingested. | Supported |
| | Determine rule's first run | Supported | Not supported |
| Rule lookback | Configurable lookbackLookback support | SupportedLookback is flexible:
- Up to 48 hours for frequency higher than one hour
- Up to 14 days for frequency of one hour and less | Supported (public preview)In public preview. Parity with analytics rules on Sentinel data. |
| Rule data | Defender XDR data | Not supported | Supported |
| | Sentinel analytics tier | Supported | Supported |
| Automated actions | Native Defender XDR remediation actions | Not supported | Supported |
@@ -26,10 +26,9 @@ ms.author: pauloliveria author: poliveria ms.reviewer: nonutkev ms.topic: product-comparison-ms.date: 2026-10-04T00:00:00.0000000Z+ms.date: 2026-05-19T00:00:00.0000000Z ai-usage: ai-assisted ms.collection: ms-security-ms.custom: msecd-doc-authoring-1030 locale: en-us document_id: e077c24d-c9ad-2350-c27c-0ca841d756bc document_version_independent_id: a2c87e85-8daa-bb87-ecbb-87e92b0c29f8@@ -71,11 +70,11 @@ Important | | Enrich alerts with custom details | Supported | Supported |
| | Define alert title and description dynamically - Integrate query results in runtime | Supported | Supported |
| | Define all alerts properties dynamically - Integrate query results in runtime | Supported | Planned |
-| **Rule frequency** | Flexible rule frequency | Supported | [Supported (public preview)](/en-us/defender-xdr/custom-detection-rules#custom-frequency-and-lookback-preview) |
+| **Rule frequency** | Support flexible and high frequency for Sentinel data | Supported | Supported |
| | Near-real-time (NRT) rules on Sentinel data | Supported | [Supported](/en-us/defender-xdr/custom-detection-rules#queries-you-can-run-continuously) |
| | NRT streaming technology - Test events as they stream, not sensitive to ingestion delays | Not supported. Analytics NRT rules test events after they're ingested. | Supported |
| | Determine rule's first run | Supported | Not supported |
-| **Rule lookback** | Configurable lookback | Supported | [Supported (public preview)](/en-us/defender-xdr/custom-detection-rules#custom-frequency-and-lookback-preview) |
+| **Rule lookback** | Lookback support | Lookback is flexible:<br>- Up to 48 hours for frequency higher than one hour<br>- Up to 14 days for frequency of one hour and less | [In public preview](/en-us/defender-xdr/custom-detection-rules#lookback). Parity with analytics rules on Sentinel data. |
| **Rule data** | Defender XDR data | Not supported | Supported |
| | Sentinel analytics tier | Supported | Supported |
| **Automated actions** | Native Defender XDR remediation actions | Not supported | Supported |