Question

You are creating a scheduled analytics rule in Microsoft Sentinel to detect brute-force sign-in attempts. You configure the rule to run every 1 hour with a lookup (query) period of 15 minutes. After deployment, the SOC reports that some brute-force bursts are not generating alerts even though the raw data is present in the workspace. What is the most likely cause and the correct remediation?

Accepted Answer

The lookup period (15 minutes) is shorter than the run frequency (1 hour), creating coverage gaps where events between query windows are never evaluated; set the lookup period to at least equal the run frequency.

Answer

The rule template lacks a MITRE ATT&CK technique mapping, which prevents the analytics engine from evaluating results; add the Credential Access tactic to enable detection.

Answer

Near-real-time (NRT) rules are the only rule type that can detect brute-force activity; convert the scheduled rule to an NRT rule to eliminate the gap.

Answer

The event grouping setting is configured to 'Trigger an alert for each event', which suppresses aggregated brute-force patterns; change it to group all events into a single alert.