|
| 1 | +--- |
| 2 | +title: Create and manage custom data collection rules in Microsoft Defender for Endpoint |
| 3 | +description: Learn how to create and manage custom data collection rules in Microsoft Defender for Endpoint to enhance your threat hunting capabilities. |
| 4 | +ms.service: defender-endpoint |
| 5 | +f1.keywords: |
| 6 | + - NOCSH |
| 7 | +ms.author: lwainstein |
| 8 | +author: limwainstein |
| 9 | +ms.localizationpriority: medium |
| 10 | +manager: bagol |
| 11 | +audience: ITPro |
| 12 | +ms.collection: |
| 13 | + - m365-security |
| 14 | + - tier1 |
| 15 | + - usx-security |
| 16 | +ms.topic: how-to |
| 17 | +search.appverid: |
| 18 | + - MOE150 |
| 19 | + - MET150 |
| 20 | +ms.date: 11/12/2025 |
| 21 | +appliesto: |
| 22 | + - Microsoft Defender for Endpoint |
| 23 | +--- |
| 24 | + |
| 25 | +# Create and manage custom data collection rules in Microsoft Defender for Endpoint (Preview) |
| 26 | + |
| 27 | +[!INCLUDE [Prerelease information](../includes/prerelease.md)] |
| 28 | + |
| 29 | +[Custom data collection (Preview)](custom-data-collection.md) enables organizations to expand and customize telemetry collection beyond default configurations to support specialized threat hunting and security monitoring needs. |
| 30 | + |
| 31 | +Custom data collection rules allow you to define specific events and analyze the data to enhance your security visibility and threat hunting operations. Custom data collection rules are based on tailored filters for event properties such as folder paths, process names, and network connections. |
| 32 | + |
| 33 | +This article shows you how to create and manage custom data collection rules in the Microsoft Defender portal. |
| 34 | + |
| 35 | +## Create custom data collection rules |
| 36 | + |
| 37 | +### Prerequisites |
| 38 | + |
| 39 | +To use custom data collection, check that you have the following prerequisites: |
| 40 | + |
| 41 | +- A Microsoft Defender for Endpoint P2 license. |
| 42 | +- A connected [Microsoft Sentinel workspace](/azure/sentinel/quickstart-onboard): required for custom data storage and querying. You can currently only connect one Sentinel workspace per Defender for Endpoint tenant for custom data collection. |
| 43 | +- Dynamic tags configured in [Asset Rule Management](/defender-xdr/configure-asset-rules) for device targeting. To use a tag for custom data collection, the tag should be run at least once. |
| 44 | + |
| 45 | +### Supported operating systems |
| 46 | + |
| 47 | +- **Windows 10 and 11** with a minimum Defender for Endpoint client version of 10.8805. |
| 48 | + - Windows 10 requires enrollment in [Extended Security Updates (ESU) program](/windows/whats-new/extended-security-updates). |
| 49 | + |
| 50 | +### Performance and limits |
| 51 | + |
| 52 | +- Each collection rule can capture up to 25,000 events per device within a 24-hour rolling window. Once the device reaches the limit, telemetry for the specific rule on the specific device stops until the window resets. |
| 53 | + - If the device reaches the threshold early in the cycle, it can take up to 24 hours for telemetry to resume. For example, if the device reaches the limit one hour after the window resets, telemetry resumes after 23 hours. |
| 54 | + - If the device reaches the threshold near the end of the window, the delay is shorter. For example, if the device reaches the limit two hours before the window resets, telemetry resumes after two hours. |
| 55 | +- Rule deployment typically takes 20 minutes to one hour. |
| 56 | +- Custom collection operates alongside default Defender for Endpoint configuration without interference. |
| 57 | + |
| 58 | +### Data costs |
| 59 | + |
| 60 | +Custom data collection is included with Microsoft Defender for Endpoint P2 licensing. However, data ingestion into Microsoft Sentinel workspaces incurs charges based on your Sentinel billing arrangement. |
| 61 | + |
| 62 | +### Create rules |
| 63 | + |
| 64 | +1. In the Microsoft Defender portal, navigate to **Settings** > **Endpoints** > **Rules** > **Custom Data Collection**. |
| 65 | + |
| 66 | + :::image type="content" source="media/custom-data-collection/custom-data-collection-main-view.png" alt-text="Screenshot of the main Custom Data Collection page." lightbox="media/custom-data-collection/custom-data-collection-main-view.png"::: |
| 67 | + |
| 68 | +1. To switch your Microsoft Sentinel workspace, select the workspace name on the top right, and select the workspace. |
| 69 | +1. Select **Create rule**. In the **General Information** section, type a rule name and description, and select **Next**. |
| 70 | + |
| 71 | + :::image type="content" source="media/create-custom-data-collection-rules/create-custom-data-collection-rule-general.png" alt-text="Screenshot of creating a rule: General Information page." lightbox="media/create-custom-data-collection-rules/create-custom-data-collection-rule-general.png"::: |
| 72 | + |
| 73 | +1. In the **Create rule** section: |
| 74 | + |
| 75 | + 1. Select which table you want to collect data from. For more information, see [Supported event tables](custom-data-collection.md#supported-event-tables). |
| 76 | + 1. Select the action for which you want to collect data. |
| 77 | + 1. Add rule conditions to filter the data even further. You can add multiple conditions to refine the data collection. Rule conditions are based on the selected table. For more information, see the respective table link under [Supported event tables](custom-data-collection.md#supported-event-tables). |
| 78 | + |
| 79 | + :::image type="content" source="media/create-custom-data-collection-rules/create-custom-data-collection-rule.png" alt-text="Screenshot of creating a rule: Create rule page." lightbox="media/create-custom-data-collection-rules/create-custom-data-collection-rule.png"::: |
| 80 | + |
| 81 | +1. Select **Next**. |
| 82 | + |
| 83 | +1. In the **Define rule scope** section, select whether you want to collect data from all applicable client devices or from specific devices that include dynamic tags. For more information, see [Create dynamic rules for devices in asset rule management](/defender-xdr/configure-asset-rules). |
| 84 | + |
| 85 | + :::image type="content" source="media/create-custom-data-collection-rules/create-custom-data-collection-rule-define-scope.png" alt-text="Screenshot of creating a rule: Define scope page." lightbox="media/create-custom-data-collection-rules/create-custom-data-collection-rule-define-scope.png"::: |
| 86 | + |
| 87 | + > [!NOTE] |
| 88 | + > Custom data collection only supports dynamic tags. |
| 89 | +
|
| 90 | +1. In the **Review and finish** section, review your rule settings, and select **Submit**. |
| 91 | + |
| 92 | + :::image type="content" source="media/create-custom-data-collection-rules/create-custom-data-collection-rule-review.png" alt-text="Screenshot of creating a rule: Review and finish page." lightbox="media/create-custom-data-collection-rules/create-custom-data-collection-rule-review.png"::: |
| 93 | + |
| 94 | +It can take up to an hour for the rule to be deployed to the targeted devices. |
| 95 | + |
| 96 | +## Monitor and troubleshoot |
| 97 | + |
| 98 | +If rules aren't working as expected: |
| 99 | + |
| 100 | +- Create a broad rule to collect events in an unexpected use case. For example, create a rule that collects all network events where `port not equals 0`. |
| 101 | +- Apply individual filters and tags to isolate issues. |
| 102 | +- If a device isn't responding after you enable the feature, reboot the device. |
| 103 | + |
| 104 | +Review these considerations when monitoring and troubleshooting custom data collection rules: |
| 105 | + |
| 106 | +- Endpoint detection and response (EDR) exclusions may override custom collection rules. |
| 107 | +- Dynamic tags update approximately every hour. Check the **Custom collection** > **Last run time** column for the status. |
| 108 | + |
| 109 | +## Edit, delete, and enable or disable custom data collection rules |
| 110 | + |
| 111 | +- To edit a rule, navigate to **Settings** > **Endpoints** > **Rules** > **Custom Collection**, select the rule you want to edit, and select **Edit**. |
| 112 | +- To disable or enable a rule, select the rule you want to modify, and select or clear the **Enable** check-box under the rule description. When you disable a rule,data collection for that rule stops on all targeted devices. |
| 113 | +- To delete a rule, select the rule you want to delete, and select **Delete**. When you delete a rule, the rule is permanently removed from the system. |
| 114 | + |
| 115 | +[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)] |
0 commit comments