From 1528c8d644b41fa4ced156eaa2e73a8d6201d702 Mon Sep 17 00:00:00 2001 From: lomayor Date: Thu, 26 Sep 2019 14:49:14 -0700 Subject: [PATCH] AH-cust-det --- .../microsoft-defender-atp/custom-detection-rules.md | 2 ++ .../microsoft-defender-atp/overview-custom-detections.md | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index 11808c3b8c..b003e60b35 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -116,3 +116,5 @@ You can also take the following actions on the rule from this page: ## Related topic - [Custom detections overview](overview-custom-detections.md) +- [Advanced hunting overview](overview-hunting.md) +- [Learn the Advanced hunting query language](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md index 8398ee9986..425427b295 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md @@ -28,11 +28,12 @@ With custom detections, you can proactively monitor for and respond to various e Custom detections work with [Advanced hunting](overview-hunting.md), which provides a powerful, flexible query language that covers a broad set of event and system information from your network. The queries run every 24 hours, generating alerts and taking response actions whenever there are matches. Custom detections provide: -- Alerts from rule-based detections built from Advanced hunting queries +- Alerts for rule-based detections built from Advanced hunting queries - Automatic response actions that apply to files and machines >[!NOTE] >To create and manage custom detections, [your role](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) needs to have the **manage security settings** permission. ## Related topic -- [Create and manage custom detection rules](custom-detection-rules.md) \ No newline at end of file +- [Create and manage custom detection rules](custom-detection-rules.md) +- [Advanced hunting overview](overview-hunting.md) \ No newline at end of file