Sentinel Analytics Rule Coverage

TL;DR: This skill reviews your Microsoft Sentinel analytics rules to confirm which are enabled, where MITRE ATT&CK coverage has gaps, and which rules are noisy or stale.

What does Sentinel analytics rule coverage tell you?

Microsoft Sentinel uses analytics rules (scheduled, near real-time, and built-in detections) to turn ingested log data into alerts and incidents, often surfaced through the Microsoft Defender portal as part of Microsoft Defender XDR. Each rule can be mapped to MITRE ATT&CK tactics and techniques, so the MITRE coverage matrix shows where your detections are strong and where adversary techniques go unwatched. This skill inspects rule status, technique mapping, run frequency, and recent alert volume to highlight disabled detections, coverage gaps, and rules that are either too noisy or no longer firing.

When should you run this skill?

• “Which Sentinel analytics rules are disabled or never deployed?”
• “Where are the gaps in our MITRE ATT&CK coverage?”
• “Which detection rules are generating too many alerts and creating noise?”
• “Are any rules stale and no longer firing alerts?”
• “Do our scheduled rules have MITRE tactics and techniques mapped?”
• “How many built-in detection templates are we not using yet?”
• “What is our overall detection coverage health before an audit?”

How this skill works, step by step

1. Connect read-only to the Microsoft Sentinel workspace, or to Microsoft Sentinel surfaced in the Microsoft Defender portal.
2. Enumerate all analytics rules, including scheduled, near real-time (NRT), Microsoft security, fusion, and anomaly rules.
3. Record each rule’s status (enabled or disabled) and compare deployed rules against available built-in detection templates.
4. Read the MITRE ATT&CK tactics and techniques mapped to each enabled rule and build a coverage view against the framework matrix.
5. Identify tactics and techniques with no active detection (coverage gaps) and techniques covered only by disabled rules.
6. Inspect recent alert volume per rule to flag noisy rules (very high alert counts) and stale rules (no alerts over the lookback window despite being enabled).
7. Check rule run frequency, query period, and last-modified dates to spot misconfigured or abandoned detections.
8. Derive a risk score by weighting disabled high-value rules, uncovered MITRE tactics, noisy rules, and stale rules, then categorise each finding as High, Medium, or Low.
9. Compile the findings into a prioritised report with remediation pointers.

Output format

The skill returns a table of analytics rules and coverage findings, followed by a summary.

Summary highlights include:

• Count of enabled versus disabled rules and unused built-in templates.
• MITRE ATT&CK tactics and techniques with no active coverage.
• List of noisy rules ranked by alert volume.
• List of stale rules that have not fired within the lookback period.
• Overall coverage health score with prioritised remediation actions.

Licensing and permissions

Licences and add-ons

Least-privilege roles

• Microsoft Sentinel Reader (read-only view of rules, alerts, and incidents)
• Log Analytics Reader (read workspace data for alert volume queries)

Microsoft Graph permissions (read-only)

Microsoft Sentinel analytics rules are administered through Azure Resource Manager and the Microsoft Sentinel REST API, not the Microsoft Graph security analytics surface, so this skill uses Azure role-based access control rather than Microsoft Graph scopes. Inspection is performed via the Azure portal, the Defender portal, or the Az.SecurityInsights PowerShell module and ARM REST endpoints in read-only mode.

Scope and safety

This skill is read-only by default. It enumerates and reports on analytics rules and alert metadata without changing detection configuration.

This skill does NOT:

• Enable, disable, create, or delete any analytics rule.
• Modify MITRE technique mappings, query logic, or rule scheduling.
• Close, suppress, or alter alerts and incidents.
• Change workspace, role, or data connector settings.

Related skills

• Sentinel Data Connector Coverage: run before this to confirm which log sources are actively ingesting
• MITRE ATT&CK Coverage Gap: run after this to see where detection coverage has gaps against MITRE ATT&CK
• Defender Advanced Hunting Pack: run after this to run curated read-only KQL hunting queries in Defender XDR
• Defender Incident Hygiene Review: run after this to check the Defender XDR incident queue for response gaps

Sources and compliance

• Detect threats out-of-the-box in Microsoft Sentinel 
• View MITRE ATT&CK framework coverage in Microsoft Sentinel 
• Maps to the Essential Eight control for monitoring and detection that supports incident response, aligned with the ASD Essential Eight Maturity Model .
• Supports ISM event logging and monitoring expectations by validating that detection rules are active and mapped to known adversary techniques.

Licensed under CC BY 4.0  by EDUC4TE .

Last reviewed 2026-06-04