Purpose of This Lesson

Microsoft Defender Advanced Hunting uses Kusto Query Language (KQL) to investigate security data across Defender data sources. Instead of relying only on graphical filters, a SOC analyst can query tables, narrow results by time or entity, select only useful columns, and investigate indicators such as file names, CVEs, devices, accounts, and IP addresses.

The practical goal is not to query every record. It is to move from a broad dataset to a focused set of evidence that supports alert triage, threat hunting, and incident investigation.

Key Concepts

Advanced Hunting in Microsoft Defender

In the Microsoft Defender portal, Advanced Hunting provides an interactive workspace for running KQL queries against available security data. The left-side schema view exposes tables and columns that can be used in queries.

A useful investigation workflow is:

1. Identify the relevant table, such as DeviceEvents, DeviceLogonEvents, DeviceInfo, EmailEvents, or AlertEvidence.
2. Start with a time restriction to avoid searching unnecessary data.
3. Add filters for the device, account, file, CVE, or other indicator under investigation.
4. Limit the number of returned rows and sort them so the most relevant records are easy to review.
5. Project only the columns required for the investigation.

The available data and results depend on the tenant, enabled Defender services, sensor coverage, and the selected time range.

Important KQL Operators

Operator or function	Purpose	Example use
where	Filters rows that meet a condition	Limit events to one device or account
ago()	Defines a relative time period	Search events from the last 24 hours
take	Returns a specified number of rows	Preview 100 records
top	Returns the highest or lowest rows according to a sort expression	Find the most recent events
sort by	Orders the result set	Sort by Timestamp desc
project	Returns only selected columns	Show DeviceId and OSPlatform
has	Searches for a value within a string field	Find a CVE in an alert title
let	Defines a reusable variable or expression	Reuse a value in a longer query
print	Produces a simple calculated or literal result	Test whether a variable works

KQL statements are connected with the pipe character (|). A let statement must be terminated with a semicolon before the query continues.

Common Defender Hunting Tables from the Lesson

• DeviceEvents: Events generated by devices, including many endpoint activity types.
• DeviceRegistryEvents: Registry changes observed on devices.
• DeviceLogonEvents: Logon activity, including account and network details.
• DeviceInfo: Device inventory and platform information.
• EmailEvents: Email-related activity, including attachment information.
• AlertEvidence: Evidence associated with alerts, useful for pivoting on titles, files, or other indicators.
• Defender Vulnerability Management tables, such as software inventory data: Useful for examining installed software and affected platforms.

The exact records returned by these tables depend on the services connected to the tenant and the data retained there.

Microsoft Security Operations Context

Advanced Hunting is most valuable after an analyst has a question to answer. For example:

• Did a suspicious account log on to a device during the investigation window?
• Which devices generated evidence associated with a specific CVE?
• Are there registry changes on a particular endpoint?
• Which email events included attachments?
• Which platforms contain a particular software or vulnerability exposure?

A typical SOC workflow is to begin with an alert or incident in Microsoft Defender XDR, identify an entity or indicator, and then use Advanced Hunting to expand or validate the scope. The result can help determine whether the alert is isolated, part of a broader campaign, or a false positive.

Advanced Hunting should complement—not replace—alert context, incident timelines, device investigation, and evidence preservation. A query result is evidence to interpret, not automatically proof of malicious activity.

Tool / Feature Decision Guide

Investigation need	Suitable table or approach	Why
Review endpoint activity	DeviceEvents	Provides a broad view of events reported by devices
Investigate registry modifications	DeviceRegistryEvents	Focuses the search on registry activity
Trace interactive or network logons	DeviceLogonEvents	Supports filtering by account, device, and related logon details
Identify device platforms	DeviceInfo with project	Reduces inventory output to fields such as device ID and OS platform
Find emails with attachments	EmailEvents with an attachment-count filter	Narrows email activity to messages containing files
Pivot from an alert to associated objects	AlertEvidence	Connects alert records with evidence such as titles and file names
Check software or platform exposure	Defender Vulnerability Management inventory data	Helps identify affected software or operating-system platforms
Test a value or reusable expression	let and print	Validates KQL syntax and variable behavior before building a larger query

KQL Notes

Time filtering

Advanced Hunting uses a default time window of the last 30 days in the interface described in the lesson. Analysts can select a custom range, but a query should still apply an appropriate time filter for efficiency and investigative accuracy.

A basic pattern is:

DeviceEvents
| where Timestamp > ago(1d)

This searches for device events newer than one day. The time range should match the incident timeline; searching too short a period can miss related activity, while searching too broadly can increase noise and processing requirements.

Sorting and limiting results

To review the most recent records first and avoid displaying the entire table:

DeviceRegistryEvents
| take 100
| sort by Timestamp desc

For a more deterministic “most recent” selection, analysts commonly use top with an explicit sort expression:

DeviceEvents
| top 10 by Timestamp desc

Filtering and selecting columns

String and equality filters can focus the investigation on a device or account:

DeviceLogonEvents
| where Timestamp > ago(24h)
| where AccountName == "user@example.com"

Use project when the complete table is unnecessarily wide:

DeviceInfo
| take 100
| project DeviceId, OSPlatform

For a CVE or other text value in an alert title, has is useful when an exact full-string match is not required:

AlertEvidence
| where Title has "CVE-2021-44228"

The field names and capitalization must match the schema available in the tenant. Use the table and column reference pane or IntelliSense to verify names before troubleshooting the query.

Variables

A let statement creates a reusable value or expression:

let InvestigationUser = "user@example.com";
DeviceLogonEvents
| where AccountName == InvestigationUser

Variables are particularly helpful when the same value is used in several parts of a longer query. A simple print statement can test a literal or variable independently.

Exam-Relevant Takeaways

• Advanced Hunting in Microsoft Defender uses KQL to query security telemetry and evidence.
• The table selected should match the investigation question; do not use a broad device table when a specialized table is more appropriate.
• Use where to filter rows, ago() for relative time windows, sort by or top to prioritize records, and project to reduce returned columns.
• let variables require a terminating semicolon and can make longer queries easier to maintain.
• has is useful for finding a value within text, such as a CVE in an alert title.
• The portal’s default time range is the last 30 days, but analysts can choose a custom range.
• Query results vary between tenants because data collection, activity, licensing, and retention differ.
• A table can exist in the schema without containing useful records for the current tenant or investigation period.
• Correct syntax and exact schema field names are essential. IntelliSense and the table schema help reduce errors.

Common Exam Traps

• Confusing take with sorting: take 100 limits rows but does not by itself guarantee that they are the newest or most relevant. Add an explicit sort or use top ... by when ordering matters.
• Ignoring the time range: A valid query can return nothing simply because the selected period does not include the event.
• Assuming identical lab results: Two tenants can return different results because their endpoints, users, services, and collected telemetry differ.
• Using the wrong table: Device inventory, registry changes, logons, email activity, and alert evidence are separate investigative data sets.
• Using single equals for comparison: Equality comparisons use ==; a single = is not the normal equality operator in the examples covered here.
• Forgetting the let semicolon: A variable declaration must end before the next statement begins.
• Treating an indicator match as a verdict: A matching file name, CVE, or title requires context and validation before escalation or remediation.
• Returning every column unnecessarily: Wide result sets make triage harder. Use project to display the fields needed for the question.

Real-World SOC Analyst Notes

• Start with a narrow, documented question and expand the search only when evidence justifies it. This reduces alert fatigue and improves query efficiency.
• Preserve the original alert, incident ID, query text, time range, and UTC investigation timestamps in case the result must be reproduced.
• When pivoting on a file name or account, check whether the value is common in the environment. Common administrative tools and scripts can generate both legitimate and malicious activity.
• Use endpoint, identity, email, and vulnerability evidence together. A single table rarely provides the complete incident story.
• Be cautious when using AI to generate KQL. AI can help explain syntax or draft a query, but the analyst must validate table names, fields, time boundaries, and the returned records before using the output operationally.
• Avoid making tenant-wide remediation decisions from an exploratory query alone. Confirm scope, coordinate with the responsible team, and follow change-control and evidence-handling procedures.
• If no records are returned, check the time range, data connector or sensor coverage, table name, field name, permissions, and retention before concluding that no activity occurred.

Quick Reference Summary

• Portal path: Microsoft Defender portal → Hunting → Advanced Hunting.
• Core workflow: Select table → constrain time → filter entity or indicator → sort or limit → project relevant columns → interpret results.
• Endpoint tables: DeviceEvents, DeviceRegistryEvents, DeviceLogonEvents, DeviceInfo.
• Messaging and alert tables: EmailEvents, AlertEvidence.
• Most-used query tools: where, ago, take, top, sort by, project, has, let, and print.
• Operational rule: Empty or inconsistent results may reflect tenant telemetry and retention rather than an absence of activity.

Flashcards

Q: Which Defender feature should an analyst use to query endpoint, email, alert, and inventory telemetry with KQL?
A: Microsoft Defender Advanced Hunting. It provides a query workspace and schema view for investigating available Defender data.

Q: An analyst needs to investigate registry modifications on one endpoint. Which table is the best starting point and why?
A: DeviceRegistryEvents, because it is specialized for registry activity and can then be filtered by device and time.

Q: When should an analyst use DeviceLogonEvents instead of DeviceInfo?
A: Use DeviceLogonEvents to investigate account logon activity; use DeviceInfo for device inventory attributes such as operating-system platform.

Q: What is the purpose of adding where Timestamp > ago(24h) to a query?
A: It restricts results to events from the last 24 hours, aligning the search with the investigation window and reducing irrelevant data.

Q: What is the difference between take 100 and top 10 by Timestamp desc?
A: take 100 limits the output but does not express which rows should be selected. top 10 by Timestamp desc explicitly returns the ten most recent records.

Q: Which KQL operator should be used to display only DeviceId and OSPlatform from a wide table?
A: project. It selects the columns needed for review and makes the result easier to interpret.

Q: An alert title may contain a CVE along with other text. Which filter is appropriate for searching that title?
A: Use has, such as where Title has "CVE-...", to find the value within the title text.

Q: What syntax detail is required after a KQL let variable declaration?
A: End the declaration with a semicolon before starting the next statement.

Q: Why might two analysts running the same Advanced Hunting query see different results?
A: Their tenants or lab environments may have different devices, activity, enabled services, collected telemetry, or retained data.

Q: An Advanced Hunting query returns no records for a known indicator. What should be checked first?
A: Verify the time range, table and column names, indicator spelling, permissions, and whether the relevant Defender sensor or data source is collecting data.

Q: When is AlertEvidence more useful than a broad endpoint-events table?
A: Use AlertEvidence when pivoting from an existing alert to associated indicators such as a title or file name.

Q: Why should an analyst use project during an investigation rather than return every available column?
A: Narrow output improves readability and focuses analysis on evidence relevant to the current question.

Q: Is a matching CVE or file name by itself enough to classify an event as malicious?
A: No. It is an investigation pivot that must be evaluated with surrounding alert, device, identity, and timeline context.

Q: What is a safe way to use AI when writing KQL for a SOC investigation?
A: Use it to draft or explain a query, then validate the syntax, schema, time range, permissions, and results before relying on it.

Practice Questions

Question 1

A SOC analyst wants the ten most recent device events, but the query currently uses only take 10. What should the analyst do?

A. Replace take 10 with project Timestamp
B. Add an explicit descending timestamp sort or use top 10 by Timestamp desc
C. Change the time range to 30 days
D. Use print before the table name

Correct answer: B

take limits the number of rows but does not communicate that the newest records should be selected. An explicit descending timestamp order or top ... by expresses that requirement.

Question 2

An investigation concerns logons by analyst@example.com during the previous 24 hours. Which query pattern is most appropriate?

A. DeviceInfo | project AccountName
B. DeviceLogonEvents | where Timestamp > ago(24h) | where AccountName == "analyst@example.com"
C. EmailEvents | where AttachmentCount >= 1
D. AlertEvidence | print "analyst@example.com"

Correct answer: B

DeviceLogonEvents contains logon activity, and the two where clauses constrain both the time period and account under investigation.

Question 3

A query searches AlertEvidence for a CVE, but the CVE is embedded in a longer alert title. Which filter is the best choice?

A. where Title has "CVE-..."
B. where Title == "CVE-..." in every case
C. project Title == "CVE-..."
D. sort by Title has "CVE-..."

Correct answer: A

has searches for the value within a text field. An exact equality comparison may fail when the title contains additional text.

Question 4

A learner runs a valid query copied from a lab demonstration but receives no rows. Which explanation is most likely to require investigation before changing the query logic?

A. Advanced Hunting never supports time filters
B. The tenant may not have the same devices, activity, sensors, or retained data as the demonstration environment
C. where can only filter email events
D. KQL cannot query Defender data

Correct answer: B

Advanced Hunting results are tenant-dependent. The analyst should also verify the selected time range, schema, permissions, and data collection coverage.

Question 5

An analyst wants to use the same account value in several parts of a long query. Which feature is most suitable?

A. let, terminated with a semicolon
B. take, followed by a comma
C. print, which permanently changes the table
D. project, which creates a global variable

Correct answer: A

let defines a reusable variable or expression. The declaration must end with a semicolon before the rest of the query is evaluated.