What's changed: Created SC-200 Chapter 5 (Domain 3: hunting in Defender XDR (KQL table selection like DeviceProcessEvents/identify threats with KQL/create Advanced Hunting queries/interpret threat analytics); hunting graphs (blast radius)/entity-relationship analysis with Sentinel Graph; Sentinel platform (hunting queries/bookmarks/KQL jobs in Data lake/Summary rule tables/Notebooks and Sentinel MCP Server connection)).
5.3Hunting on the Sentinel platform
Understand creating/monitoring Microsoft Sentinel hunting queries, creating/managing KQL jobs in Data lake, creating/managing Summary rule tables, and hunting with Notebooks (including connecting to the Sentinel MCP Server).
Microsoft Sentinel provides a platform for large-scale hunting over org-wide logs. Analysts choose between interactive queries, batch-style jobs over large data, summary tables, and advanced analysis via Notebooks.
5.3.1Hunting queries and KQL jobs
Hunting queries save/run/monitor hypothesis-based KQL and bookmark hits to carry into investigation (promote to analytics rules if needed). For large data (especially the Data lake tier), create a KQL job rather than interactive runs to execute large-scale queries in batch and store results—useful for broad exploration on the cheaper Data lake instead of the costly Analytics tier.
5.3.2Summary rules and Notebooks
Summary rule tables pre-aggregate large raw logs into small summary tables, keeping frequent queries fast and low-cost (e.g., summarize daily aggregates). Notebooks (Jupyter) enable advanced analysis, ML, and visualization in Python beyond KQL, and can connect to the Sentinel MCP Server to drive hunting from AI agents/external tools. Analysts combine these by scale and sophistication.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.