Microsoft Defender XDR
Hunting and detectionAdvanced Hunting Migrate From Mde
In brief
The documentation now clarifies migration queries from Microsoft Defender for Endpoint, including PowerShell technique filtering, AlertInfo and AlertEvidence joins, and entity filtering. It also updates the Microsoft Defender XDR setup link and publication date.
What Defender admins need to know
Administrators can use the revised examples to more accurately adapt existing queries and locate the current setup guidance.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Original Defender for Endpoint query
The following query usesfinds recent DeviceAlertEvents records in Microsoft Defender for Endpoint to get the alerts that are associated with PowerShell technique T1086 and involve powershell.exe:
DeviceAlertEvents
<a name="modified-query"></a>
### Modified query for Microsoft Defender XDR
The following query has been adjustedmigrates the original Defender for Endpoint query for use in Microsoft Defender.Defender XDR. Instead of checking the file name directly fromquerying `DeviceAlertEvents`, directly, it uses `AlertInfo` to filter by attack technique and joins `AlertEvidence` and checksto check for the file name in that table.name.
```kusto
AlertInfo
When Microsoft Defender for Endpoint rules are edited on Microsoft Defender, they continue to function as before if the resulting query looks at device tables only.
For example, alerts generated by custom detection rules that query only device tables will continue to be delivered to your SIEM and generate email notifications, depending on how you've configured theseSIEM delivery and email notifications in Microsoft Defender for Endpoint. Any existing suppression rules in Defender for Endpoint will also continue to apply.
Once you edit a Defender for Endpoint rule so that it queries identity and email tables, which are only available in Microsoft Defender, the rule is automatically moved to Microsoft Defender.
To get the same alert information that you used to get from the `DeviceAlertEvents` table in the Microsoft Defender for Endpoint schema, filter the `AlertInfo` table by the `ServiceSource` column. The `ServiceSource` column identifies which Microsoft 365 security product generated the alert, such as `Microsoft Defender for Endpoint`, `Microsoft Defender for Office 365`, or `Microsoft Defender for Identity`. After filtering by `ServiceSource`, join each unique ID with the `AlertEvidence` table, which provides detailed event and entity information.
The following sample query filtersnarrows `AlertInfo` to alerts generated by `ServiceSource`Microsoft Defender for Endpoint and joins `AlertEvidence` on `AlertId`: to retrieve the associated evidence:
```kusto
AlertInfo
| join AlertEvidence on AlertId
ThisThe previous query yields many more columns than DeviceAlertEvents in the Microsoft Defender for Endpoint schema. To keep results manageable, use project to get only the columns you are interested in. The following query projectsbuilds on the previous example by adding a PowerShell filter and using project to return only the columns that are useful when investigating PowerShell activity:
AlertInfo
| project Timestamp, Title, AlertId, DeviceName, FileName, ProcessCommandLine
If you'd like toYou can also filter for specific entities involved in the alerts, you can do so by specifyingalerts. Building on the entity type in EntityType andprevious examples, the value you would like to filter for. The following query retrieves all evidence forlooks up a specific alert title by joiningtitle, joins AlertInfo with AlertEvidence, to retrieve the related evidence records, and then filtersnarrows the results to a specific IP address:address by filtering on EntityType and RemoteIP:
AlertInfo
For more information about advanced hunting and Microsoft Defender XDR, see the following articles:
- [Turn on Microsoft Defender]Defender XDR](advanced-hunting-query-language.m365d-enable.md)
- [Advanced hunting overview](advanced-hunting-overview.md)
- [Understand the schema](advanced-hunting-schema-tables.md)
- [Advanced hunting in Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview)
@@ -16,7 +16,7 @@ ms.custom: - seo-marvel-apr2020 appliesto: Microsoft Defender XDR ms.topic: how-to-ms.date: 06/16/2026+ms.date: 07/02/2026 ai-usage: ai-assisted --- @@ -96,7 +96,7 @@ Microsoft Defender for Endpoint queries will work as-is unless they reference th <a name="original-query"></a> ### Original Defender for Endpoint query -The following query uses `DeviceAlertEvents` in Microsoft Defender for Endpoint to get the alerts that involve _powershell.exe_:+The following query finds recent `DeviceAlertEvents` records in Microsoft Defender for Endpoint that are associated with PowerShell technique T1086 and involve _powershell.exe_: ```kusto DeviceAlertEvents@@ -107,7 +107,7 @@ DeviceAlertEvents <a name="modified-query"></a> ### Modified query for Microsoft Defender XDR -The following query has been adjusted for use in Microsoft Defender. Instead of checking the file name directly from `DeviceAlertEvents`, it joins `AlertEvidence` and checks for the file name in that table.+The following query migrates the original Defender for Endpoint query for use in Microsoft Defender XDR. Instead of querying `DeviceAlertEvents` directly, it uses `AlertInfo` to filter by attack technique and joins `AlertEvidence` to check for the file name. ```kusto AlertInfo@@ -121,7 +121,7 @@ AlertInfo When Microsoft Defender for Endpoint rules are edited on Microsoft Defender, they continue to function as before if the resulting query looks at device tables only. -For example, alerts generated by custom detection rules that query only device tables will continue to be delivered to your SIEM and generate email notifications, depending on how you've configured these in Microsoft Defender for Endpoint. Any existing suppression rules in Defender for Endpoint will also continue to apply.+For example, alerts generated by custom detection rules that query only device tables will continue to be delivered to your SIEM and generate email notifications, depending on how you've configured SIEM delivery and email notifications in Microsoft Defender for Endpoint. Any existing suppression rules in Defender for Endpoint will also continue to apply. Once you edit a Defender for Endpoint rule so that it queries identity and email tables, which are only available in Microsoft Defender, the rule is automatically moved to Microsoft Defender. @@ -150,7 +150,7 @@ In the Microsoft Defender XDR schema, the `AlertInfo` and `AlertEvidence` tables To get the same alert information that you used to get from the `DeviceAlertEvents` table in the Microsoft Defender for Endpoint schema, filter the `AlertInfo` table by the `ServiceSource` column. The `ServiceSource` column identifies which Microsoft 365 security product generated the alert, such as `Microsoft Defender for Endpoint`, `Microsoft Defender for Office 365`, or `Microsoft Defender for Identity`. After filtering by `ServiceSource`, join each unique ID with the `AlertEvidence` table, which provides detailed event and entity information. -The following sample query filters `AlertInfo` by `ServiceSource` and joins `AlertEvidence` on `AlertId`:+The following query narrows `AlertInfo` to alerts generated by Microsoft Defender for Endpoint and joins `AlertEvidence` on `AlertId` to retrieve the associated evidence: ```kusto AlertInfo@@ -159,7 +159,7 @@ AlertInfo | join AlertEvidence on AlertId ``` -This query yields many more columns than `DeviceAlertEvents` in the Microsoft Defender for Endpoint schema. To keep results manageable, use `project` to get only the columns you are interested in. The following query projects columns that are useful when investigating PowerShell activity:+The previous query yields many more columns than `DeviceAlertEvents` in the Microsoft Defender for Endpoint schema. To keep results manageable, use `project` to get only the columns you are interested in. The following query builds on the previous example by adding a PowerShell filter and using `project` to return only the columns that are useful when investigating PowerShell activity: ```kusto AlertInfo@@ -170,7 +170,7 @@ AlertInfo | project Timestamp, Title, AlertId, DeviceName, FileName, ProcessCommandLine ``` -If you'd like to filter for specific entities involved in the alerts, you can do so by specifying the entity type in `EntityType` and the value you would like to filter for. The following query retrieves all evidence for a specific alert title by joining `AlertInfo` with `AlertEvidence`, and then filters the results to a specific IP address:+You can also filter for specific entities involved in the alerts. Building on the previous examples, the following query looks up a specific alert by title, joins `AlertInfo` with `AlertEvidence` to retrieve the related evidence records, and then narrows the results to a specific IP address by filtering on `EntityType` and `RemoteIP`: ```kusto AlertInfo@@ -184,7 +184,7 @@ AlertInfo For more information about advanced hunting and Microsoft Defender XDR, see the following articles: -- [Turn on Microsoft Defender](advanced-hunting-query-language.md)+- [Turn on Microsoft Defender XDR](m365d-enable.md) - [Advanced hunting overview](advanced-hunting-overview.md) - [Understand the schema](advanced-hunting-schema-tables.md) - [Advanced hunting in Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview)