windows-itpro-docs/windows/security/threat-protection/windows-defender-atp/overview-custom-detections.md

title, description, keywords, search.product, search.appverid, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.author, author, ms.localizationpriority, manager, audience, ms.collection, ms.topic, ms.date

title	description	keywords	search.product	search.appverid	ms.prod	ms.mktglfcycl	ms.sitesec	ms.pagetype	ms.author	author	ms.localizationpriority	manager	audience	ms.collection	ms.topic	ms.date
Custom detections overview	Understand how how you can leverage the power of advanced hunting to create custom detections	custom detections, detections, advanced hunting, hunt, detect, query	eADQiWindows 10XVcnh	met150	w10	deploy	library	security	macapara	mjcaparas	medium	dansimp	ITPro	M365-security-compliance	conceptual	10/29/2018

Custom detections overview

Applies to:

• Windows Defender Advanced Threat Protection (Windows Defender ATP)

Alerts in Windows Defender ATP are surfaced through the system based on signals gathered from endpoints. With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats.

This can be done by leveraging the power of Advanced hunting through the creation of custom detection rules. Custom detections are queries that run periodically every 24 hours and can be configured so that when the query meets the criteria you set, alerts are created and are surfaced in Windows Defender Security Center. These alerts will be treated like any other alert in the system.

This capability is particularly useful for scenarios when you want to pro-actively prevent threats and be notified quickly of emerging threats.

Related topic

• Create custom detection rules