Sentinel analytics rule types: NRT vs Fusion vs TI vs ML Behavior
Verdict: NRT runs once a minute. Fusion and Threat Intelligence Analytics use hidden logic you cannot edit. TI matches indicators against CEF, Syslog and DNS. ML Behavior Analytics flags anomalous SSH and RDP logins.
| Criterion | Scheduled | NRT | Fusion (multistage) | Threat Intelligence Analytics | ML Behavior Analytics |
|---|---|---|---|---|---|
| Cadence | Analyst-set frequency | Once every minute | Continuous correlation | Continuous matching | Model-driven |
| Logic customisable | Yes, analyst KQL | Yes, analyst KQL | No, hidden | No, hidden | No, hidden |
| Instances per workspace | Many | Many | One only | One | One |
| What it detects | Any KQL condition | Same as scheduled, faster | Correlated multistage attacks | IP, domain and URL indicators in CEF, Syslog, DNS | Anomalous SSH and RDP logins by IP, geo and history |
Rules
- Use an NRT rule when a detection must fire as close to real time as possible; it is the type built to run once every minute.
- Fusion and Microsoft Threat Intelligence Analytics both use non-customisable hidden logic; only enablement and excluded sources are configurable.
- Match Syslog or CEF network-appliance logs against Microsoft indicators with the Microsoft Threat Intelligence Analytics rule for high-fidelity alerts.
- Detect anomalous SSH and RDP logins by IP, geolocation and user history without custom KQL using the ML Behavior Analytics rule.
Traps
- A scheduled rule can run frequently, but only the NRT type is purpose-built for a one-minute cadence.
- Fusion allows only one rule instance per workspace and its correlation logic cannot be edited.