Create and manage custom detection rules in Microsoft Defender XDR using Advanced Hunting - SC-200 Manage a Security Operations Environment

Create and manage custom detection rules in Microsoft Defender XDR using Advanced Hunting.

Build custom detection rules in Microsoft Defender XDR by promoting Advanced Hunting queries, setting detection frequency, and mapping impacted entities such as devices, users, and mailboxes. Manage the rule lifecycle by editing, disabling, and reviewing rule status to ensure detections remain accurate and do not generate excessive noise.

custom detection rules from Advanced Hunting queriesdetection frequency and response actionsmanaging custom detection rulesimpacted entities

Practice question for this objective

Free sampleManage a Security Operations Environmentmedium

Your team maintains a Microsoft Defender XDR custom detection rule whose Advanced Hunting query joins the endpoint and identity tables. You also ingest a verbose custom application log into a dedicated custom table in your Microsoft Sentinel workspace, and an engineer proposes extending the same custom detection rule's query to reference that Sentinel custom table so a single rule covers both data sets. Why will referencing that Microsoft Sentinel custom table inside a Microsoft Defender XDR custom detection rule fail to work as proposed?

AA Microsoft Defender XDR custom detection rule can query Microsoft Sentinel custom tables, but only after the workspace is upgraded to the unified data lake tier for cross-product queries.
BA Microsoft Defender XDR custom detection rule can reference any table, but a custom table breaks alert deduplication because Sentinel custom tables never contain a ReportId column.
CA Microsoft Defender XDR custom detection rule cannot use a query that joins more than two tables, so adding the Sentinel custom table exceeds the join limit the rule allows.
DA Microsoft Defender XDR custom detection rule runs only over the Microsoft Defender XDR Advanced Hunting schema, so a Microsoft Sentinel workspace custom table is not available to its query. Correct

Recognise that a Microsoft Defender XDR custom detection rule queries only the XDR Advanced Hunting schema and cannot reference arbitrary Microsoft Sentinel workspace custom tables. Custom detection rules are built and run inside Microsoft Defender XDR Advanced Hunting, so their queries resolve only against the XDR tables (the endpoint, identity, email, and cloud app schema). A custom table that exists in a Microsoft Sentinel Log Analytics workspace is not part of that schema, so the query reference cannot bind. To detect on workspace-scoped custom data you would build a Microsoft Sentinel scheduled analytics rule instead.

Why A is wrong: Tempting because the data lake does broaden query reach, but a custom detection rule still binds to the XDR schema; no tier upgrade exposes a Sentinel custom table to it.

Why B is wrong: Tempting because ReportId matters for deduplication, but the genuine reason is scope: the rule cannot see the Sentinel custom table at all, not merely that one column is absent.

Why C is wrong: Tempting because complex joins feel risky, but there is no two-table join cap on custom detection rules; the blocker is that the Sentinel custom table is outside the XDR Advanced Hunting schema.

Why D is correct: Correct: custom detection rules execute against the XDR Advanced Hunting tables, which do not include arbitrary Microsoft Sentinel workspace custom tables, so the proposed reference cannot resolve.

See more SC-200 practice questions, answers explained.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.

Create and manage custom detection rules in Microsoft Defender XDR using Advanced Hunting.

Practice question for this objective

More in this domain