Sentinel analytics rule types: scheduled vs NRT vs Microsoft security vs anomaly vs Fusion
This sheet compares Scheduled rules, NRT rules, Microsoft security rules, Anomaly rules, Fusion.
| Criterion | Scheduled rules | NRT rules | Microsoft security rules | Anomaly rules | Fusion |
|---|---|---|---|---|---|
| How it works | Kusto query over a lookback period at set intervals | A limited subset of scheduled rules, runs each minute | Builds incidents from alerts in other Microsoft solutions | Machine learning learns a baseline and flags deviations | ML correlates low-fidelity alerts across products |
The verdict, the full comparison, 4 rules and 2 traps are part of SC-900 access. Unlock SC-900.