Create custom alerts with Microsoft Sentinel! How to design security rules for your company

**1. What is a Custom Alert? **

Custom alerts are a mechanism that allows you to set your own conditions and create alerts.
You can freely define "access to specific IPs" and "behavior of specific users" that cannot be covered by templates.

The main applications are:

• Detection based on your own security policy
• Monitoring limited to specific subnets and resources
• Notification triggers for internal SOCs and operations teams

2. Overview of Creation Procedure

You can create a custom alert by following these steps:

1. Open Microsoft Sentinel → Analytics
2. Click + Create
3. Select the rule type in Scheduled rule
4. Set rule name, description, query, schedule, etc.
5. Specify notification methods and automatic responses (e.g., playbooks)
6. Activate in "Create"

3. Query Examples and Ideas

At the core of alerting creation is querying with the Kusto Query Language (KQL).
Here's a simple example:

Example: Query to detect sign-in from an international IP

kql

SigninLogs
| where Location !contains "Japan"
| where ResultType == 0
| project UserPrincipalName, IPAddress, Location, TimeGenerated

In this way, we will assemble "which logs to target", "when to meet what conditions", and "what to display".

4. Setting Up Schedules and Notifications

Once the query is complete, the next thing to do is to configure the following:

• Execution frequency
  Every 15 minutes, every hour, etc.

• Detection conditions
  Example: Notification if even one hit, notification if 10 or more hits, etc.

• Notification content

  • Automatically create incidents?
  • Notify the security team
  • Launch the playbook in Logic Apps, for example,

• Notifications can also be linked to "Automation Rules" later.

5. Post-Creation Checkpoints

Once you've created your custom alert, check the following:

• Are the results of the query as expected (pre-tested with Logs)
• Are there any over-detections or false positives (adjust the severity of the condition)
• Notifications and playbooks are working correctly (check the test logs)

Alerts don't end with making, they need to be continuously improved.

6. Summary: Key Points for Custom Alert Design

 

Monitoring and notifications that cannot be covered by templates can be flexibly supplemented with custom alerts.
If you want to implement more advanced detection logic or automated response, please feel free to contact Colorkrew Security.