Custom detection rules in Defender XDR advanced hunting; MITRE ATT&CK coverage of your rules

Advanced hunting in the Defender portal lets you query up to 30 days of raw Defender XDR data with Kusto Query Language (KQL), and, when Sentinel is onboarded, Sentinel tables as well. A custom detection rule is a saved advanced hunting query that runs on a schedule and raises alerts, and optionally takes response actions, whenever it returns results. It is the Defender XDR counterpart of a Sentinel scheduled analytics rule, and its alerts join incidents in the same queue as built-in detections.