What's changed: Created SC-200 Chapter 5 (Domain 3: hunting in Defender XDR (KQL table selection like DeviceProcessEvents/identify threats with KQL/create Advanced Hunting queries/interpret threat analytics); hunting graphs (blast radius)/entity-relationship analysis with Sentinel Graph; Sentinel platform (hunting queries/bookmarks/KQL jobs in Data lake/Summary rule tables/Notebooks and Sentinel MCP Server connection)).
5.1Hunting and KQL in Defender XDR
Understand selecting the appropriate table for a KQL query, identifying threats with Kusto Query Language (KQL), creating Advanced Hunting queries, and interpreting threat analytics in Microsoft Defender XDR.
Threat hunting proactively forms "compromise hypotheses" and searches data without waiting for alerts. Advanced Hunting in Defender XDR queries across tables with KQL (Kusto Query Language) to identify threats.
5.1.1Table selection and KQL
In KQL, first choose the table matching "what to look for"—device processes = DeviceProcessEvents, network connections = DeviceNetworkEvents, sign-ins = IdentityLogonEvents, email = EmailEvents, etc. The wrong table will not surface the traces you seek. Build queries with where (filter), project (select columns), summarize (aggregate), join, etc., to test hypotheses.
5.1.2Interpreting threat analytics
Threat analytics are threat reports from Microsoft security research about ongoing campaigns and new techniques—showing affected assets, recommended actions, and related detection/hunting queries. Analysts read threat analytics to check whether their org is affected, then proactively hunt with the provided queries—quickly assessing readiness against the latest threats.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.