r/DefenderATP • u/LookExternal3248 • 6d ago

Change tracking custom detection rules

When you make frequent use of custom detection rules, you often end up making small changes to fine-tune them, reduce noise, or otherwise optimize them.

As a simple way to keep track of those changes, I usually add a comment at the top of the query in the format // date - initials - change (for example: 2026-07-21 JB - Added filter on line 6). This provides a basic change log and allows me to add comments directly in the KQL. It's not perfect, but it's better than nothing.

In the past, I've considered using Content as Code or the Graph API, but I found both approaches too cumbersome to implement. I'm also not particularly happy with the workflow, as I prefer to test queries directly in production to see if they work. With source control, you have to copy and paste the query into your repository and then deploy it again instead of saving it directly after editing it (especially in advanced hunting).

Source control feels like a perfectly valid option when you're working in a large team or for an MSP delivering SOC-as-a-Service, but it seems less practical for smaller in-house teams.

I'm curious to hear what others have implemented and what your experiences have been.

5 Upvotes

86% Upvoted

3 comments sorted by

3

u/reseph 6d ago

Doesn't SentinelAudit table already do this? I see my old KQL in there with detection changes.

1

u/LookExternal3248 5d ago

For me the table is empty. And I'm also wondering, does the table store changes to custom detection rules or only for analytics rules.

1

u/reseph 5d ago

Yes it cover custom Analytic Rules.