What's changed: Created SC-200 Chapter 5 (Domain 3: hunting in Defender XDR (KQL table selection like DeviceProcessEvents/identify threats with KQL/create Advanced Hunting queries/interpret threat analytics); hunting graphs (blast radius)/entity-relationship analysis with Sentinel Graph; Sentinel platform (hunting queries/bookmarks/KQL jobs in Data lake/Summary rule tables/Notebooks and Sentinel MCP Server connection)).
5.3Hunting on the Sentinel platform
Understand creating/monitoring Microsoft Sentinel hunting queries, creating/managing KQL jobs in Data lake, creating/managing Summary rule tables, and hunting with Notebooks (including connecting to the Sentinel MCP Server).
Microsoft Sentinel provides a platform for large-scale hunting over org-wide logs. Analysts choose between interactive queries, batch-style jobs over large data, summary tables, and advanced analysis via Notebooks.
5.3.1Hunting queries and KQL jobs
Hunting queries save/run/monitor hypothesis-based KQL and bookmark hits to carry into investigation (promote to analytics rules if needed). For large data (especially the Data lake tier), create a KQL job rather than interactive runs to execute large-scale queries in batch and store results—useful for broad exploration on the cheaper Data lake instead of the costly Analytics tier.
5.3.2Summary rules and Notebooks
Summary rule tables pre-aggregate large raw logs into small summary tables, keeping frequent queries fast and low-cost (e.g., summarize daily aggregates). Notebooks (Jupyter) enable advanced analysis, ML, and visualization in Python beyond KQL, and can connect to the Sentinel MCP Server to drive hunting from AI agents/external tools. Analysts combine these by scale and sophistication.
Cues: "save/run/monitor hypothesis KQL and bookmark hits" = hunting queries. "batch large-scale queries over Data lake big data" = KQL jobs. "pre-aggregate raw logs for speed/low cost" = Summary rules. "advanced Python analysis/ML, MCP Server connection" = Notebooks.
Watch the mix-ups: (1) Interactive hunting queries vs batch KQL jobs over Data lake. (2) Summary rules (pre-aggregated tables) differ from analytics rules (detection). (3) Notebooks are for advanced analysis—simple exploration is fine with ordinary hunting queries.
5.3.3Section summary
- Hunting queries = save/run/monitor hypothesis KQL and bookmark; large Data lake data uses batch KQL jobs
- Summary rules = pre-aggregate raw logs for speed/low cost; Notebooks = advanced Python analysis/ML, Sentinel MCP Server connection
- Choose by scale (interactive/batch) and sophistication (aggregation/Notebooks)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. For large logs stored in the Data lake tier, you want to run large-scale KQL in batch (not interactively) and store the results. Which is best?
Q2. To make frequent aggregate queries fast and low-cost, you want a small table pre-aggregated from large raw logs. Which is best?
Q3. Beyond KQL, you want advanced Python analysis and ML, connecting to the Sentinel MCP Server to drive hunting. Which is best?
Q4. You want to save/run/monitor hypothesis-based KQL and carry hits into investigation. Which is best?
Q5. Which correctly distinguishes Summary rules from analytics rules?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.