Microsoft Defender XDR
Hunting and detection

Custom Detection Manage

In brief

The Edit description no longer mentions flexible frequency and lookback being in public preview or links to related guidance. Author and date metadata also changed.

What Defender admins need to know

No administrator action is stated; administrators will no longer find those preview details on this page.

Summaries are generated from the documentation change itself.

Documentation change

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • m365initiative-m365-defender

  • tier2 ms.custom:

  • msecd-doc-authoring-10301014

  • cx-ti

  • cx-ah ms.topic: how-to ms.date: 2026-10-04T00:07-02T00:00:00.0000000Z ai-usage: ai-assisted locale: en-us document_id: 76dfe3e6-2253-8172-d91e-df741bf40f4f

  • Open detection rule page - opens the detection rule page to view triggered alerts and review actions (for custom detection rules only)

  • Run - runs the rule immediately; this also resets the interval for the next run (for custom detection rules only)

  • Edit - opens the rule wizard where you can modify the rule settings and the query. Flexible frequency and lookback for all supported data sources are in public preview. For more information, see Custom frequency and lookback.query

  • Modify query - opens the query directly in advanced hunting for editing

  • Turn on / Turn off - allows you to enable the rule or stop it from running

  • Delete - turns off the rule and permanently removes it