3.3 Advanced Hunting

Advanced Hunting

Advanced hunting is the KQL query interface that gives you direct access to every data table across all Defender products. The incident queue shows you what the system detected. Advanced hunting shows you everything the system recorded — whether it triggered an alert or not. This is where you go when the automated detections are not enough and you need to ask your own questions.

Two modes: KQL and guided

KQL mode is the raw query editor. You type KQL directly and run it against the unified schema. This is what experienced analysts use daily. The schema explorer on the left shows every available table, grouped by product: Device tables from Defender for Endpoint, Email tables from Defender for Office 365, Identity tables from Defender for Identity, CloudApp tables from Defender for Cloud Apps, and Alert/Incident tables that span all products.

Guided mode is a point-and-click query builder for analysts who are learning KQL or building simple queries quickly. You select a table, pick columns, add conditions through dropdown menus, and the system generates the KQL for you. It is useful for getting started, but you will outgrow it quickly — the investigation scenarios in Phase 3 require queries that guided mode cannot build.

Figure 3.3: Advanced hunting provides a single query surface across all product data tables.

Custom detection rules

Advanced hunting is not just for ad-hoc investigation. You can save a query as a custom detection rule that runs on a schedule and generates alerts or incidents when results are found. This is how you create detections for threats that Microsoft’s built-in rules do not cover — and it is the bridge between Module 2 (writing queries) and Module 10 (building analytics rules in Sentinel).

The workflow: write a query that surfaces the activity you want to detect, test it against historical data to verify it finds what you expect without excessive false positives, then save it as a custom detection with an alert title, severity, entity mapping, and run frequency.

Practical examples

Hunt for inbox rule creation across all mailboxes:

1
2
3
4
5
6

CloudAppEvents
| where TimeGenerated > ago(7d)
| where ActionType == "New-InboxRule"
| extend RuleName = tostring(RawEventData.Parameters[0].Value)
| project TimeGenerated, AccountDisplayName, RuleName, IPAddress
| sort by TimeGenerated desc

Find sign-ins from IPs that have never been associated with any user in your organisation:

1
2
3
4
5
6
7
8
9

let known_ips = SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| distinct IPAddress;
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0
| where IPAddress !in (known_ips)
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, Location