Your Security Delivery Agent can now review detection rules

By ContraForce · Published October 29, 2026

Announcement · October 29, 2026 · 4 min read

Start an agent rule review from a Microsoft Sentinel scheduled or NRT analytics rule, or from a Defender XDR custom detection. Your Security Delivery Agent reads the rule's recent incidents and recommends whether and how to change it, with the detection coverage risk and a validation plan for your team to weigh.

A detection rule can generate plenty of activity without delivering the signal your team needs. Deciding what to change takes context: what the rule fired on, how your analysts classified those incidents, and what a proposed adjustment could miss.

Your Security Delivery Agent can now help your team make that assessment. Start an agent rule review from a workspace detection rule, and your existing agent examines the rule and its detection history, then writes a report that recommends whether and how to change it.

Which rules can be reviewed

Agent rule reviews cover Microsoft Sentinel scheduled and near-real-time (NRT) analytics rules and Microsoft Defender XDR custom detections. Other Sentinel rule types, such as Microsoft incident creation rules, can't be reviewed.

What the agent reads

The agent works from the rule's query and configuration as they stood when the review was queued. It then samples up to 15 of the rule's incidents, starting with the preceding three days and widening the window up to 30 days when fewer are available. The sample spans days and classifications and includes true positives when there are any, so confirmed threats are part of the picture alongside the noise.

For each incident, the agent reads the classification with its reason and comment, the incident comments (including notes from earlier Security Delivery Agent investigations), the alerts and the entities. It can also run a limited number of lookups, such as KQL table and schema queries, sign-in and directory logs, and related incidents.

One conclusion, then the findings

Each report opens with exactly one of five conclusions, then a summary and the findings behind it:

• Rule tuning recommended: the query or rule configuration should change.
• External configuration change recommended: keep the rule and change something around it, such as an automation rule, a conditional-access policy or a watchlist.
• Rule and external changes recommended: both kinds of change.
• Keep current rule: the evidence supports leaving the rule as it is.
• Insufficient evidence: the evidence does not support a defensible decision.

Three of the five don't propose any change to the rule itself. For a noisy rule, the better fix is sometimes outside the query, and sometimes the evidence says to leave the rule alone. Insufficient evidence is a completed review, not a failure.

Recommendations name their detection coverage risk

Each recommendation, whether a rule change or an external configuration change, gives its rationale, the proposed action, its detection coverage risk and a validation plan. A rule change also shows the exact current and proposed value of each setting it would change.

The detection coverage risk describes what the change could cause the rule to miss. An exclusion that quiets alerts from a nightly job's service account could also hide an attacker using that account. With the risk written next to the change, whoever approves it can weigh a quieter queue against what the rule could stop catching.

The validation plan suggests how to test the change against your own data. It's a plan for your team, not proof that the agent ran the test.

Compare the exact query change

When a recommendation changes the query, the report adds a Query changes section with the complete current and proposed queries. Additions are marked with a plus sign and removals with a minus sign, and unchanged lines stay in place for context.

Choose Inline to read the changes in one sequence, or Side-by-side to put the current query on the left and the proposed query on the right. That's where you check the exact edit, such as whether an exclusion matches only the intended account.

Evidence coverage shows what the agent saw

Evidence coverage lists the reviewed incidents and the limits of the evidence, such as a window that held fewer incidents than the sample allows. Follow-up lists items to check before you decide. Print / Save as PDF gives you a copy for your change records.

Your team keeps control of every change

Before you adopt a recommendation, validate it against your workspace data and check both whether it reduces noise and whether it could miss true positives. Then make a rule change through your usual Content Management Center change and approval process.

Advisory only

An agent rule review never changes, approves, deploys or disables a rule, and it never submits a Content Management Center change. The report has no apply button. Your team decides what to validate, approve and deploy.

Start a review

Workspace Owners and Content Admins can start a review on a workspace that has a Security Delivery Agent, and the agent reviews a rule only when someone on your team asks it to. Open the rule from the workspace's Detection Rules page, and on Rule details select Actions, then Agent rule review.

A good first candidate is a noisy rule your analysts keep closing as benign positive with reasons and comments, since that history is what the agent reads.

Completed reports stay on the agent's page under Run History, then Rule Reviews, with the conclusion for each run. Completed there means the review finished, not that anything was applied.

Starting new reviews requires the Content Management Center. On ContraForce pricing the Content Management Center is an add-on on the Growth plan, and it is included from Scale upward: compare the plans. If that access is later removed, past reports stay readable.

The evidence window and each report section are covered in the guide to agent rule reviews.

Questions about agent rule reviews? Contact us at support@contraforce.com.

More posts