Microsoft Defender XDR

Advanced Hunting Limits

4 September 2026Doc update+2 / −2 lines

In brief

The explanation now explicitly describes the difference between average daily use and top daily use; the example values remain 75% and 100%. The document date was updated to July 2, 2026.

What Defender admins need to know

Administrators can use the clearer wording when interpreting advanced hunting resource-use metrics.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Screenshot of the query resources report showing two available view modes for reviewing resource usage over time.

~~This~~The difference between these two views means that, for instance, if on a specific day you ran two queries, one query used 50% of your resources and the other query used 100%, the average daily use value shows 75%, while the top daily use shows 100%.

@@ -17,7 +17,7 @@ appliesto:     - Microsoft Defender XDR     - Microsoft Sentinel in the Microsoft Defender portal ms.topic: how-to-ms.date: 06/16/2026+ms.date: 07/02/2026 ai-usage: ai-assisted --- @@ -92,7 +92,7 @@ The graph supports two views:  ![Screenshot of the query resources report showing two available view modes for reviewing resource usage over time.](./media/advanced-hunting-limits/resource-usage-over-time.png) -This difference means that, for instance, if on a specific day you ran two queries, one query used 50% of your resources and the other query used 100%, the average daily use value shows 75%, while the top daily use shows 100%.+The difference between these two views means that, for instance, if on a specific day you ran two queries, one query used 50% of your resources and the other query used 100%, the average daily use value shows 75%, while the top daily use shows 100%.  ## Related articles