Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
Hunting and detection

Advanced Hunting Defender Use Custom Rules

4 September 2026Doc update+21 / −12 lines

In brief

The article now warns that deleting functions and saved queries is permanent, clarifies guidance for the `adx()`, `arg()`, and `workspace()` operators, updates menu image descriptions, and renames analytics rule section headings.

What Defender admins need to know

Administrators should review the clarified cross-service query guidance and deletion warnings when managing advanced hunting content.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

To use a Microsoft Sentinel function, go to the Functions tab and scroll until you find the function that you want. Double-click the function name to insert the function in the query editor.

You can also select the vertical ellipses ( Screenshot of the More options menu icon used to access additional function actions in advanced hunting. ) to the right of the function and select Insert to query to insert the function into a query in the query editor.

Other options include:

  • View details – Opens the function side pane containing its details.

For editable functions, more options are available when you select the vertical ellipses:

  • Edit details – Opens the function side pane to allow you to edit details about the function (except folder names for Sentinel functions).
  • Delete – Deletes the function.

Use adx() operator for Azure Data Explorer queries

Use the adx() operator to query tables stored in Azure Data Explorer. For more information, see What is Azure Data Explorer?

  • Delete – Deletes the function.

Use adx() operator for Azure Data Explorer queries

The adx() operator lets you run cross-service queries against tables stored in Azure Data Explorer from advanced hunting. Use the adx() operator to include external Azure Data Explorer data in your hunting queries. For more information, see What is Azure Data Explorer?

Previously, the adx() operator was only available in log analytics in Microsoft Sentinel. Now, users can use the operator in advanced hunting in the unified Microsoft Defender portal without needing to manually open a Microsoft Sentinel window.

In the query editor, enter the adx()query to reference a table in an Azure Data Explorer cluster and database. Use the following format: 

adx('<Cluster URI>/<Database Name>').<Table Name>

Use arg() operator for Azure Resource Graph queries

Azure Resource Graph is a service that lets you query and explore your deployed Azure resources, such as subscriptions, virtual machines, CPU, and storage, across multiple subscriptions. The arg() operator brings Azure Resource Graph queries into advanced hunting so you can combine resource data with Microsoft Sentinel tables (Defender tables aren't supported).

Previously, the arg() operator was only available in the Logs feature in Microsoft Sentinel. In the Microsoft Defender portal, the arg() operator works to combine Azure Resource Graph queries with Microsoft Sentinel tables. By using the arg() operator, you can make cross-service queries in advanced hunting without manually opening a Microsoft Sentinel window.

For more information, see Query data in Azure Resource Graph by using arg().

Use workspace() operator for cross-workspace queries

When your advanced hunting query needs data from a Log Analytics workspace other than the one connected to your current environment, you can run a cross-workspace query. Use the workspace() operator to query data from a specific Log Analytics workspace in the same or a different resource group or subscription. This operator lets you include log data from other workspaces in your advanced hunting queries.

For more information, see Query across resources with Azure Monitor.

In the query editor, enteruse the workspace() operator to reference a table in a specific Log Analytics workspace. Enter the query in the following format: 

workspace('<Workspace ID or Azure Resource ID>').<Table Name>

For example, to retrievethe following query retrieves the first 10 rows of the SigninLogs table from another workspace:workspace to validate cross-workspace access: 

workspace('00000000-0000-0000-0000-000000000000').SigninLogs

## Use saved queries

To use a saved query from Microsoft Sentinel, go to the **Queries** tab and scroll until you find the query that you want. Double-click the query name to load the query in the query editor. For more options, select the vertical ellipses ( ![Vertical ellipses or kebabScreenshot of the More options menu icon for more options]used to access additional saved query actions in advanced hunting.](/defender/media/ah-kebab.png) ) to the right of the query. From here,the query options menu, you can perform the following actions:

- **Run query** – Loads the query in the query editor and runs it automatically.
- **Open in query editor** – Loads the query in the query editor.
For editable queries, more options are available:

- **Edit details** – Opens the query details side pane with the option to edit the details like description (if applicable) and the query itself. You can't edit the folder names (location) of Microsoft Sentinel queries.
- **Delete** – Deletes the query.
- **Rename** – Allows you to modify the query name.



<a name="analytics-
  • Delete – Deletes the query.
  • Rename – Allows you to modify the query name.

Create analytics rules"></a> ### Analytics rules

For analytics rules that apply to data ingested through the connected Microsoft Sentinel workspace, select **Manage rules > Create analytics rule**rule. <a name="custom-detection-rules"></a> ### Custom

Create custom detection rules

You can create custom detection rules that query data from both Microsoft Sentinel and Defender tables. Select **Manage rules > Create custom detection**detection. Read [Create custom detection rules](custom-detection-rules.md)Create custom detection rules for more information.

In both custom detection and analytics rule creation, you can only query data ingested as analytics logs (that is, not as basic logs or auxiliary logs. See [log management plans](/azure/sentinel/log-plans#log-management-plans)log management plans to check the different tiers) otherwise custom detection or analytics rule creation won't proceed.