4.6 KiB
title, description, keywords, search.product, search.appverid, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.author, author, ms.localizationpriority, manager, audience, ms.collection, ms.topic, ms.date
| title | description | keywords | search.product | search.appverid | ms.prod | ms.mktglfcycl | ms.sitesec | ms.pagetype | ms.author | author | ms.localizationpriority | manager | audience | ms.collection | ms.topic | ms.date |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Overview of Advanced hunting | Use threat hunting capabilities in Microsoft Defender ATP to build queries that find threats and weaknesses in your network | advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, custom detections, schema, kusto | eADQiWindows 10XVcnh | met150 | w10 | deploy | library | security | lomayor | lomayor | medium | dansimp | ITPro | M365-security-compliance | article | 10/08/2019 |
Proactively hunt for threats with Advanced hunting
Applies to:
Want to experience Microsoft Defender ATP? Sign up for a free trial.
Advanced hunting is a query-based threat-hunting tool that lets you explore up to 30 days of raw data. You can proactively inspect events in your network to locate interesting indicators and entities. The flexible access to data facilitates unconstrained hunting for both known and potential threats.
You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured machines.
Get started with Advanced hunting
We recommend going through several steps to quickly get up and running with Advanced hunting.
| Learning goal | Description | Resource |
|---|---|---|
| Get a feel for the language | Advanced hunting is based on the Kusto query language, supporting the same syntax and operators. Start learning the query language by running your first query. | Query language overview |
| Understand the schema | Get a good, high-level understanding of the tables in the schema and their columns. This will help you determine where to look for data and how to construct your queries. | Schema reference |
| Use predefined queries | Explore collections of predefined queries covering different threat hunting scenarios. | Shared queries |
| Learn about custom detections | Understand how you can use advanced hunting queries to trigger alerts and apply response actions automatically. | Custom detections overview |
Get help as you write queries
Take advantage of the following functionality to write queries faster:
- Autosuggest — as you write queries, Advanced hunting provides suggestions.
- Schema reference — a schema reference that includes the list of tables and their columns is provided next to your working area. For more information, hover over an item. Double-click an item to insert it to the query editor.
Drilldown from query results
To view more information about entities, such as machines, files, users, IP addresses, and URLs, in your query results, simply click the entity identifier. This opens a detailed profile page for the selected entity in Microsoft Defender Security Center.
Tweak your queries from the results
Right-click a value in the result set to quickly enhance your query. You can use the options to:
- Explicitly look for the selected value (
==) - Exclude the selected value from the query (
!=) - Get more advanced operators for adding the value to your query, such as
contains,starts withandends with
Filter the query results
The filters displayed to the right provide a summary of the result set. Each column has its own section that lists the distinct values found for that column and the number of instances.
Refine your query by selecting the "+" or "-" buttons next to the values that you want to include or exclude.
Once you apply the filter to modify the query and then run the query, the results are updated accordingly.