---
name: Sentinel Analytics Rule Coverage
description: Audit Microsoft Sentinel analytics rules for enabled status, MITRE ATT&CK coverage, and noisy or stale detections.
---

# Sentinel Analytics Rule Coverage

> **TL;DR:** This skill reviews your Microsoft Sentinel analytics rules to confirm which are enabled, where MITRE ATT&CK coverage has gaps, and which rules are noisy or stale.

## What does Sentinel analytics rule coverage tell you?

Microsoft Sentinel uses analytics rules (scheduled, near real-time, and built-in detections) to turn ingested log data into alerts and incidents, often surfaced through the Microsoft Defender portal as part of Microsoft Defender XDR. Each rule can be mapped to MITRE ATT&CK tactics and techniques, so the MITRE coverage matrix shows where your detections are strong and where adversary techniques go unwatched. This skill inspects rule status, technique mapping, run frequency, and recent alert volume to highlight disabled detections, coverage gaps, and rules that are either too noisy or no longer firing.

## When should you run this skill?

- "Which Sentinel analytics rules are disabled or never deployed?"
- "Where are the gaps in our MITRE ATT&CK coverage?"
- "Which detection rules are generating too many alerts and creating noise?"
- "Are any rules stale and no longer firing alerts?"
- "Do our scheduled rules have MITRE tactics and techniques mapped?"
- "How many built-in detection templates are we not using yet?"
- "What is our overall detection coverage health before an audit?"

## How this skill works, step by step

1. Connect read-only to the Microsoft Sentinel workspace, or to Microsoft Sentinel surfaced in the Microsoft Defender portal.
2. Enumerate all analytics rules, including scheduled, near real-time (NRT), Microsoft security, fusion, and anomaly rules.
3. Record each rule's status (enabled or disabled) and compare deployed rules against available built-in detection templates.
4. Read the MITRE ATT&CK tactics and techniques mapped to each enabled rule and build a coverage view against the framework matrix.
5. Identify tactics and techniques with no active detection (coverage gaps) and techniques covered only by disabled rules.
6. Inspect recent alert volume per rule to flag noisy rules (very high alert counts) and stale rules (no alerts over the lookback window despite being enabled).
7. Check rule run frequency, query period, and last-modified dates to spot misconfigured or abandoned detections.
8. Derive a risk score by weighting disabled high-value rules, uncovered MITRE tactics, noisy rules, and stale rules, then categorise each finding as High, Medium, or Low.
9. Compile the findings into a prioritised report with remediation pointers.

## Output format

The skill returns a table of analytics rules and coverage findings, followed by a summary.

| Rule name | Status | MITRE tactics | Alerts (30 days) | Finding | Risk |
| --- | --- | --- | --- | --- | --- |
| Suspicious sign-in from new location | Enabled | InitialAccess | 4 | Healthy detection | Low |
| Mass file download by user | Disabled | Exfiltration | 0 | High-value rule disabled | High |
| Rare process executed | Enabled | Execution | 1,820 | Noisy rule, needs tuning | Medium |
| Anomalous AAD app consent | Enabled | Persistence | 0 | Stale, no alerts in window | Medium |

Summary highlights include:

- Count of enabled versus disabled rules and unused built-in templates.
- MITRE ATT&CK tactics and techniques with no active coverage.
- List of noisy rules ranked by alert volume.
- List of stale rules that have not fired within the lookback period.
- Overall coverage health score with prioritised remediation actions.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Microsoft Sentinel analytics rules and MITRE coverage | Microsoft Sentinel (Azure Monitor Log Analytics workspace, pay-as-you-go or commitment tier) |
| Sentinel in the unified Microsoft Defender portal | Microsoft Sentinel plus a Microsoft Defender XDR workload licence |

### Least-privilege roles

- Microsoft Sentinel Reader (read-only view of rules, alerts, and incidents)
- Log Analytics Reader (read workspace data for alert volume queries)

### Microsoft Graph permissions (read-only)

Microsoft Sentinel analytics rules are administered through Azure Resource Manager and the Microsoft Sentinel REST API, not the Microsoft Graph security analytics surface, so this skill uses Azure role-based access control rather than Microsoft Graph scopes. Inspection is performed via the Azure portal, the Defender portal, or the `Az.SecurityInsights` PowerShell module and ARM REST endpoints in read-only mode.

## Scope and safety

This skill is read-only by default. It enumerates and reports on analytics rules and alert metadata without changing detection configuration.

This skill does NOT:

- Enable, disable, create, or delete any analytics rule.
- Modify MITRE technique mappings, query logic, or rule scheduling.
- Close, suppress, or alter alerts and incidents.
- Change workspace, role, or data connector settings.

## Sources and compliance

- [Detect threats out-of-the-box in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/detect-threats-built-in)
- [View MITRE ATT&CK framework coverage in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/mitre-coverage)
- Maps to the Essential Eight control for monitoring and detection that supports incident response, aligned with the [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model).
- Supports ISM event logging and monitoring expectations by validating that detection rules are active and mapped to known adversary techniques.
- Output in Australian English.