From 06a38e3bc57a9a17be790dc10a6db27833e624c8 Mon Sep 17 00:00:00 2001
From: ImranHabib <47118050+joinimran@users.noreply.github.com>
Date: Tue, 1 Oct 2019 13:54:56 +0500
Subject: [PATCH] Update
 windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md

Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com>
---
 .../microsoft-defender-atp/custom-detection-rules.md             | 1 +
 1 file changed, 1 insertion(+)

diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md
index 19f8bc230f..fbb2aa14e6 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md
@@ -41,6 +41,7 @@ In Microsoft Defender Security Center, go to **Advanced hunting** and select an
 | where EventTime > ago(7d)
 | where ActionType == "AntivirusDetection"
 | summarize (EventTime, ReportId)=arg_max(EventTime, ReportId), count() by MachineId
+| where count_ > 5
 This will fetch the EventTime and ReportId of the latest event from multiple events returned by the query and adds the count by MachineId.
 
 ### 2. Create new rule and provide alert details.