Microsoft Defender XDR
Hunting and detectionManage detection rule correlation settings in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn
In brief
The documentation now covers including or excluding custom detections from Microsoft Defender XDR correlation on a per-rule basis. Custom detections are included by default; exclusions create predictable single-alert incidents when no matching grouping rule applies.
What Defender admins need to know
Administrators should note the required permissions and that no tenant-level custom detection setting is available. No action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Manage analyticsdetection rule correlation settings in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn
This article explains how to include or excludeSecurity administrators can control whether alerts generated by analytics rules from theand custom detections participate in Microsoft Defender XDR correlation. Use correlation engine. Includingsettings to keep the recommended correlated incident experience or excluding analytics rules from correlation helps organizations migrating from Microsoft Sentinel maintaincreate predictable incident behavior and ensure compatibility with existing automation workflows.for specific detection scenarios.
Overview
Prerequisites
To manage analytics rule exclusions from correlation,correlation settings, you need permissions for the following permissions:type of detection rule:
- Analytics rules - The Microsoft Sentinel Contributor
ThisAzure role lets you manage Microsoft Sentinel workspace data, including alerts and detections. - Custom detections - You need permission to manage the custom detection rule. For more information, see Required permissions for managing custom detections.
Configure custom detection correlation (public preview)
Include or exclude each custom detection from correlation. Existing and new custom detection rules are included in correlation by default. Inclusion is the recommended setting because it helps combine related activity into a broader incident story.
On the custom detection rule details page, use Include or exclude from correlation to select one of these settings:
- Include in correlation - Alerts participate in Microsoft Defender XDR correlation.
- Exclude from correlation - Alerts bypass standard Microsoft Defender XDR correlation and create predictable, single-alert incidents when no matching incident alert-grouping rule applies.
Exclusion can help when a detection scenario requires predictable incident creation. For example, use exclusion to:
- Trigger automation or playbooks when an incident is created.
- Route cases to a specific team based on the detection.
- Support compliance or escalation workflows that require standalone incidents.
Custom detection correlation is configured per rule. A tenant-level correlation setting isn't available for custom detections.
Important
Incident alert-grouping rules remain the final authority. If a matching alert-grouping rule applies, it determines the final incident-grouping behavior.
How analytics rule exclusion works
Depending on your tenant's settings, you can exclude all or only specific analytics rules from correlation.
@@ -1,6 +1,6 @@ --- layout: Conceptual-title: Manage analytics rule correlation settings in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn+title: Manage detection rule correlation settings in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/defender-xdr/exclude-analytics-rules-correlation breadcrumb_path: /defender-xdr/breadcrumb/toc.json permissioned-type: public@@ -8,7 +8,7 @@ feedback_system: Standard feedback_product_url: https://techcommunity.microsoft.com/t5/microsoft-365-defender/bd-p/MicrosoftThreatProtection uhfHeaderId: MSDocsHeader-MicrosoftDefender manager: orspodek-description: Learn how to exclude specific analytics rules from the correlation engine to maintain static incident grouping behavior similar to Microsoft Sentinel.+description: Learn how to include or exclude analytics rules and custom detections from Microsoft Defender XDR correlation to control incident creation behavior. ms.service: defender-xdr ms.author: monaberdugo author: mberdugo@@ -18,9 +18,9 @@ ms.collection: - m365-security - tier2 ms.topic: how-to-ms.date: 2026-07-02T00:00:00.0000000Z+ms.date: 2026-10-04T00:00:00.0000000Z ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1016+ms.custom: msecd-doc-authoring-1030 locale: en-us document_id: aa7062ea-7e61-5cf0-7e64-035bd69cf595 document_version_independent_id: aa7062ea-7e61-5cf0-7e64-035bd69cf595@@ -37,19 +37,19 @@ monikers: [] item_type: Content source_path: defender-xdr/exclude-analytics-rules-correlation.md cmProducts:-- https://authoring-docs-microsoft.poolparty.biz/devrel/8a94907f-2511-4271-b5ca-ec7f2e75067c-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/c671beaa-a830-4c9f-aceb-97379ee031ca - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/1577a46d-8446-40bd-bfae-0578362f4d94+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/c671beaa-a830-4c9f-aceb-97379ee031ca+- https://authoring-docs-microsoft.poolparty.biz/devrel/8a94907f-2511-4271-b5ca-ec7f2e75067c spProducts:-- https://authoring-docs-microsoft.poolparty.biz/devrel/bffa8e88-f633-409d-a24d-083bdbc68872-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/8921374c-4dbe-4ed0-b011-a39e18bfbd98 - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/cdf3f22d-5420-4d59-a2bf-66d6b3d9c828+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/8921374c-4dbe-4ed0-b011-a39e18bfbd98+- https://authoring-docs-microsoft.poolparty.biz/devrel/bffa8e88-f633-409d-a24d-083bdbc68872 platformId: 86785372-a658-53a1-702d-1f14316b8fa4 --- -# Manage analytics rule correlation settings in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn+# Manage detection rule correlation settings in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn -This article explains how to include or exclude analytics rules from the Microsoft Defender XDR correlation engine. Including or excluding analytics rules from correlation helps organizations migrating from Microsoft Sentinel maintain predictable incident behavior and ensure compatibility with existing automation workflows.
+Security administrators can control whether alerts generated by analytics rules and custom detections participate in Microsoft Defender XDR correlation. Use correlation settings to keep the recommended correlated incident experience or create predictable incident behavior for specific detection scenarios.
## Overview
@@ -63,11 +63,33 @@ For more information about how correlation works in Microsoft Defender, see [Ale
## Prerequisites
-To manage analytics rule exclusions from correlation, you need the following permissions:
+To manage correlation settings, you need permissions for the type of detection rule:
+
+- **Analytics rules** - The **Microsoft Sentinel Contributor**[Azure role](/en-us/azure/role-based-access-control/built-in-roles/security#microsoft-sentinel-contributor) lets you manage Microsoft Sentinel workspace data, including alerts and detections.
+- **Custom detections** - You need permission to manage the custom detection rule. For more information, see [Required permissions for managing custom detections](custom-detection-rules#required-permissions-for-managing-custom-detections).
+
+## Configure custom detection correlation (public preview)
+
+Include or exclude each custom detection from correlation. Existing and new custom detection rules are included in correlation by default. Inclusion is the recommended setting because it helps combine related activity into a broader incident story.
+
+On the custom detection rule details page, use **Include or exclude from correlation** to select one of these settings:
+
+- **Include in correlation** - Alerts participate in Microsoft Defender XDR correlation.
+- **Exclude from correlation** - Alerts bypass standard Microsoft Defender XDR correlation and create predictable, single-alert incidents when no matching incident alert-grouping rule applies.
+
+Exclusion can help when a detection scenario requires predictable incident creation. For example, use exclusion to:
+
+- Trigger automation or playbooks when an incident is created.
+- Route cases to a specific team based on the detection.
+- Support compliance or escalation workflows that require standalone incidents.
+
+Custom detection correlation is configured per rule. A tenant-level correlation setting isn't available for custom detections.
+
+Important
-**Microsoft Sentinel Contributor** This [Azure role](/en-us/azure/role-based-access-control/built-in-roles/security#microsoft-sentinel-contributor) lets you manage Microsoft Sentinel workspace data, including alerts and detections.
+Incident alert-grouping rules remain the final authority. If a matching alert-grouping rule applies, it determines the final incident-grouping behavior.
-## How exclusion works
+## How analytics rule exclusion works
Depending on your tenant's settings, you can exclude all or only specific analytics rules from correlation.