Microsoft Defender XDR
Hunting and detectionAdvanced Hunting Query Builder Details
In brief
The page updates its date, clarifies when the EventType filter is available, and improves descriptions of EventType, sample-size, Edit in KQL, and generated KQL screenshots. It also specifies the file-name and SHA256 example when describing narrowed Emails & collaboration queries.
What Defender admins need to know
Administrators get clearer guidance when using and interpreting Query Builder examples; no action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Use EventType
You can even look for specific event types like all failed logons, file modification events, or successful network connections by using the EventType filter in any section where itthe EventType filter is applicable.available.
For instance, if you want to add a condition that looks for registry value deletions, you can go to the Registry Events section and select EventType.
Selecting EventType under Registry Events allows you to choose from different registry events, including the one you're hunting for, RegistryValueDeleted.
Test your query with a smaller sample size
If you're still working on your query and would like to see its performance and some sample results quickly, adjust the number of records to return by picking a smaller set through the Sample size dropdown menu.
The sample size is set to 10,000 results by default, which is the maximum number of records that can be returned in hunting. However, we highly recommend lowering the sample size to 10 or 100 to quickly test your query, as doing so consumes less resources while you're still working on improving the query.
Switch to advanced mode after building a query
You can click on Edit in KQL to view the KQL query generated by your selected conditions. Editing in KQL opens a new tab in advanced mode, with the corresponding KQL query:
In the file-name and SHA256 query example shown in the previous screenshot, the selected view is All, so the KQL query searches all tables that have file properties of name and SHA256, and in all the relevant columns covering these properties.
If you change the view to Emails & collaboration, the KQL query generated for the file-name and SHA256 example is narrowed down to:
Related content
@@ -18,7 +18,7 @@ appliesto: - Microsoft Defender XDR - Microsoft Sentinel in the Microsoft Defender portal ms.topic: how-to-ms.date: 06/16/2026+ms.date: 07/02/2026 ai-usage: ai-assisted --- @@ -73,15 +73,15 @@ You don't need to remember the device ID, full device name, or user account name  ## Use `EventType`-You can even look for specific event types like all failed logons, file modification events, or successful network connections by using the **EventType** filter in any section where it is applicable.+You can even look for specific event types like all failed logons, file modification events, or successful network connections by using the **EventType** filter in any section where the **EventType** filter is available. For instance, if you want to add a condition that looks for registry value deletions, you can go to the **Registry Events** section and select **EventType**. -+ Selecting EventType under Registry Events allows you to choose from different registry events, including the one you're hunting for, **RegistryValueDeleted**. -+ > [!NOTE] >`EventType` is the equivalent of `ActionType` in the data schema, which users of advanced mode might be more familiar with.@@ -89,7 +89,7 @@ Selecting EventType under Registry Events allows you to choose from different re ## Test your query with a smaller sample size If you're still working on your query and would like to see its performance and some sample results quickly, adjust the number of records to return by picking a smaller set through the **Sample size** dropdown menu. -+ The sample size is set to 10,000 results by default, which is the maximum number of records that can be returned in hunting. However, we highly recommend lowering the sample size to 10 or 100 to quickly test your query, as doing so consumes less resources while you're still working on improving the query. @@ -98,15 +98,15 @@ Then, once you finalize your query and are ready to use it to get all the releva ## Switch to advanced mode after building a query You can click on **Edit in KQL** to view the KQL query generated by your selected conditions. Editing in KQL opens a new tab in advanced mode, with the corresponding KQL query: -+ -+ In the file-name and SHA256 query example shown in the previous screenshot, the selected view is All, so the KQL query searches all tables that have file properties of name and SHA256, and in all the relevant columns covering these properties. -If you change the view to **Emails & collaboration**, the query is narrowed down to:+If you change the view to **Emails & collaboration**, the KQL query generated for the file-name and SHA256 example is narrowed down to: -+ <a name="see-also"></a> ## Related content