Sentinel Analytics Rule

resource → analytics rule (KQL + severity + entity mapping)

Creates a scheduled analytics rule in Sentinel: the KQL query, severity, entity mapping, and automated response all packaged together.

Use it when you want to turn a hunting query into an operational detection: the Sentinel analytics rule packages the KQL query, execution frequency, threshold, severity, entities (IP, account, host — the ones that feed incidents and investigations), and the alerts it generates. The rule deploys with a click from the UI or via ARM templates/API for IaC. It's the final step of the detection flow: the query that found the spray (068) becomes the rule that alerts on its own every hour. Entity mapping is what makes the incident actionable: the attacker's IP as an entity, not as text.

Don't create it without validating the query against real data: a rule with a query that returns false positives (or nothing) generates noise that ends up silenced — test the KQL in hunting before packaging it. Frequency and threshold need to be calibrated per environment: a rule that runs every 5 minutes on a large workspace has cost, and a poorly set threshold fires hundreds of alerts. And watch out for entity mapping: poorly mapped entities (a field that doesn't exist) produce incidents without context — verify the query fields against the actual table schema. For complex rules, the Sentinel rule IDE and tests in the dev environment avoid surprises.