What's changed: Created SC-200 Chapter 5 (Domain 3: hunting in Defender XDR (KQL table selection like DeviceProcessEvents/identify threats with KQL/create Advanced Hunting queries/interpret threat analytics); hunting graphs (blast radius)/entity-relationship analysis with Sentinel Graph; Sentinel platform (hunting queries/bookmarks/KQL jobs in Data lake/Summary rule tables/Notebooks and Sentinel MCP Server connection)).
5.1Hunting and KQL in Defender XDR
Understand selecting the appropriate table for a KQL query, identifying threats with Kusto Query Language (KQL), creating Advanced Hunting queries, and interpreting threat analytics in Microsoft Defender XDR.
Threat hunting proactively forms "compromise hypotheses" and searches data without waiting for alerts. Advanced Hunting in Defender XDR queries across tables with KQL (Kusto Query Language) to identify threats.
5.1.1Table selection and KQL
In KQL, first choose the table matching "what to look for"—device processes = DeviceProcessEvents, network connections = DeviceNetworkEvents, sign-ins = IdentityLogonEvents, email = EmailEvents, etc. The wrong table will not surface the traces you seek. Build queries with where (filter), project (select columns), summarize (aggregate), join, etc., to test hypotheses.
5.1.2Interpreting threat analytics
Threat analytics are threat reports from Microsoft security research about ongoing campaigns and new techniques—showing affected assets, recommended actions, and related detection/hunting queries. Analysts read threat analytics to check whether their org is affected, then proactively hunt with the provided queries—quickly assessing readiness against the latest threats.
Cues: "proactively search traces with KQL" = Advanced Hunting (first pick the right table—processes = DeviceProcessEvents, etc.). "Microsoft-provided threat reports to check your org’s impact and hunt with recommended queries" = threat analytics. Hunting is proactive exploration, distinct from detection rules (repeated detection).
Watch the mix-ups: (1) The wrong table hides traces—pick the table matching your goal. (2) Advanced Hunting (proactive exploration) vs custom detection rules (promotion to repeated detection). (3) Threat analytics (threat reports) differ from analytics rules (detection).
5.1.3Section summary
- Advanced Hunting = proactive KQL search; pick the right table (processes:DeviceProcessEvents/network:DeviceNetworkEvents/sign-ins:IdentityLogonEvents)
- Threat analytics = Microsoft-provided threat reports; check your org’s impact and hunt with recommended queries
- Hunting (proactive exploration) is distinct from detection rules (repeated detection)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to hunt for traces of processes executed on devices in Advanced Hunting. Which table is most appropriate to start with?
Q2. You want a Microsoft threat report to check whether your org is affected by an ongoing campaign and hunt with recommended queries. Which is best?
Q3. In a KQL query, when "the traces you seek do not appear," what should you suspect first?
Q4. Which correctly relates threat hunting and custom detection rules?
Q5. Which table suits hunting for sign-in (logon) traces in Advanced Hunting?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.