Threat Detection Engine Details

Last published : Nov 11, 2026
This section is the reference for the Threat Detection Engine: the rule syntax, the event types, and the event properties you can use in rules.
Related information
ESA Features & Configuration
Rule SyntaxEvent TypesCommon Event PropertiesDNS Query Event PropertiesFile System Activity Event PropertiesImage Load Event PropertiesNetwork Event PropertiesRegistry Event PropertiesRemote Thread Event PropertiesProcess.DirectorySdSddl