Turning a hunting query into a custom detection rule; Security Copilot help with writing KQL

Hunting is exploratory: you form a hypothesis, query, and learn. When a hunt finds something worth watching for continuously, you promote it into a detection so the next occurrence raises an alert without a human remembering to look. In Defender XDR that means a custom detection rule; in Sentinel, a scheduled or near-real-time (NRT) analytics rule. The move from hunt to detection is how a security operations center (SOC) turns one analyst's insight into permanent coverage.