Skip to content

Commit 56688fb

Browse files
committed
added dedup description
1 parent 9210345 commit 56688fb

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

defender-xdr/custom-detections-overview.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ Custom detections provide:
3939
- Alerts for rule-based detections built from advanced hunting queries
4040
- Automatic response actions
4141

42+
Custom detections also help reduce alert noise and fatigue by grouping and deduplicating events into a single alert, helping you focus on incidents that matter. For example, if a custom detection fires twice on an event that contains the same entities, custom details, and dynamic details, only one alert is created for both of these events. If the detection recognizes that the events are identical, it logs only one of the events on the created alert and then takes care of the duplicates, which could occur when the lookback period is longer than the frequency. If the events are different, the custom detection logs both events on the alert.
43+
4244
Optimizing your queries in custom detection rules is important in avoiding time-outs and ensuring efficiency. There are several resources available that provide guidance on optimizing your queries in [Advanced hunting query best practices](advanced-hunting-best-practices.md).
4345

4446
## See also

0 commit comments

Comments
 (0)