From 2c4bd9224255a238a58b350b87d695de61ed89b0 Mon Sep 17 00:00:00 2001 From: lomayor Date: Mon, 23 Mar 2020 17:38:07 -0700 Subject: [PATCH] viz --- windows/security/threat-protection/TOC.md | 1 + .../advanced-hunting-overview.md | 26 +++---------------- .../advanced-hunting-query-language.md | 1 + .../advanced-hunting-query-results.md | 6 ++--- .../advanced-hunting-schema-reference.md | 1 + 5 files changed, 9 insertions(+), 26 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 9f036fee96..a92bf04aa9 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -105,6 +105,7 @@ ### [Advanced hunting]() #### [Advanced hunting overview](microsoft-defender-atp/advanced-hunting-overview.md) #### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md) +#### [Work with query results](microsoft-defender-atp/advanced-hunting-query-results.md) #### [Use shared queries](microsoft-defender-atp/advanced-hunting-shared-queries.md) #### [Advanced hunting schema reference]() ##### [Understand the schema](microsoft-defender-atp/advanced-hunting-schema-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index 1496f2342f..0950e4d750 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -1,7 +1,7 @@ --- title: Overview of advanced hunting in Microsoft Defender ATP description: Use threat hunting capabilities in Microsoft Defender ATP to build queries that find threats and weaknesses in your network -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, custom detections, schema, kusto +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp, search, query, telemetry, custom detections, schema, kusto search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -41,36 +41,16 @@ You can also go through each of the following steps to ramp up your advanced hun | **Learn how to use the query results** | Learn about charts and various ways you can view or export your results. Explore how you can quickly tweak queries and drill down to get richer information. | [Work with query results](advanced-hunting-query-results.md) | | **Understand the schema** | Get a good, high-level understanding of the tables in the schema and their columns. This will help you determine where to look for data and how to construct your queries. | [Schema reference](advanced-hunting-schema-reference.md) | | **Use predefined queries** | Explore collections of predefined queries covering different threat hunting scenarios. | [Shared queries](advanced-hunting-shared-queries.md) | -| **Learn about custom detections** | Understand how you can use advanced hunting queries to trigger alerts and apply response actions automatically. | [Custom detections overview](overview-custom-detections.md) | +| **Learn about custom detections** | Understand how you can use advanced hunting queries to trigger alerts and apply response actions automatically. | - [Custom detections overview](overview-custom-detections.md)
- [Custom detection rules](custom-detections-rules.md) | ## Get help as you write queries Take advantage of the following functionality to write queries faster: - **Autosuggest** — as you write queries, advanced hunting provides suggestions from IntelliSense. - **Schema reference** — a schema reference that includes the list of tables and their columns is provided next to your working area. For more information, hover over an item. Double-click an item to insert it to the query editor. -## Drilldown from query results -To view more information about entities, such as machines, files, users, IP addresses, and URLs, in your query results, simply click the entity identifier. This opens a detailed profile page for the selected entity in Microsoft Defender Security Center. - -## Tweak your queries from the results -Right-click a value in the result set to quickly enhance your query. You can use the options to: - -- Explicitly look for the selected value (`==`) -- Exclude the selected value from the query (`!=`) -- Get more advanced operators for adding the value to your query, such as `contains`, `starts with` and `ends with` - -![Image of Microsoft Defender ATP advanced hunting result set](images/atp-advanced-hunting-results-filter.png) - -## Filter the query results -The filters displayed to the right provide a summary of the result set. Each column has its own section that lists the distinct values found for that column and the number of instances. - -Refine your query by selecting the "+" or "-" buttons next to the values that you want to include or exclude. - -![Image of advanced hunting filter](images/atp-filter-advanced-hunting.png) - -Once you apply the filter to modify the query and then run the query, the results are updated accordingly. - ## Related topics - [Learn the query language](advanced-hunting-query-language.md) +- [Work with query results](advanced-hunting-query-results.md) - [Use shared queries](advanced-hunting-shared-queries.md) - [Understand the schema](advanced-hunting-schema-reference.md) - [Apply query best practices](advanced-hunting-best-practices.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md index 85f9a0c799..337c1fafca 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md @@ -137,6 +137,7 @@ For detailed information about the query language, see [Kusto query language doc ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) +- [Work with query results](advanced-hunting-query-results.md) - [Understand the schema](advanced-hunting-schema-reference.md) - [Apply query best practices](advanced-hunting-best-practices.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md index 0abff695f1..e23a5e62a4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md @@ -1,7 +1,7 @@ --- title: Work with advanced hunting query results in Microsoft Defender ATP description: Make the most of the query results returned by advanced hunting in Microsoft Defender ATP -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, custom detections, schema, kusto, visualization, chart, filters, drill-down +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, custom detections, schema, kusto, visualization, chart, filters, drill down search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -86,13 +86,13 @@ DeviceAlertEvents | summarize Count = count() by MachineGroup | top 10 by Count ``` -Use the pie chart view to effectively show distribution across the top domains: +Use the pie chart view to effectively show distribution across the top groups: ![Image of advanced hunting query results displayed as a pie chart](images/advanced-hunting-pie-chart.jpg) *Pie chart showing distribution of alerts across machine groups* #### Malware detections over time -Using the `summarize` operator with the `bin()` function, you can check for events involving a particular indicator over time. The query below counts detections of an EICAR test file at 30 minute intervals to show spikes in activity related to that file: +Using the `summarize` operator with the `bin()` function, you can check for events involving a particular indicator over time. The query below counts detections of an EICAR test file at 30 minute intervals to show spikes in detections of that file: ```kusto DeviceEvents diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md index 6e13b372ef..e90dbf5e55 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md @@ -55,4 +55,5 @@ Table and column names are also listed within the Microsoft Defender Security Ce ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) +- [Work with query results](advanced-hunting-query-results.md) - [Learn the query language](advanced-hunting-query-language.md)