Determine Mean Time to Detect for Analytics Rules
This analytics rule measures Mean Time to Detect (MTTD) for alerts generated by Sentinel analytics rules. It correlates rule execution data from SentinelHealth with corresponding alerts in SecurityAlert and incidents in SecurityIncident to determine how long it took for an analytics rule to detect malicious or suspicious activity after the first related event occurred. The query retrieves all successful analytics rule executions within the specified time window, joins them to alerts using the CorrelationId, and then maps those alerts to incidents through AlertIds. For each alert–incident pair, the rule calculates MTTD as the difference between the rule run time and the first activity time associated with the incident. Results are aggregated by alert name and severity to provide counts and average detection times, enabling visibility into detection performance and rule efficacy.
Microsoft Sentinel (KQL)
