Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
Hunting and detection

Advanced Hunting Query Results

4 September 2026Doc update+15 / −9 lines

In brief

The article adds stable anchors and clearer “Example chart” headings, refines query descriptions, identifies the newly added filter, and documents when the timeline appears: results must contain more than 40 events and a `Timestamp` or `timeGenerated` column.

What Defender admins need to know

Administrators can link directly to examples and better understand chart and timeline behavior when reviewing query results.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • cx-ah
  • sfi-image-nochange ms.topic: how-to ms.date: 06/16/07/02/2026 appliesto:
  • Microsoft Defender XDR
  • Microsoft Sentinel in the Microsoft Defender portal

When rendering charts, advanced hunting automatically identifies columns of interest and the numeric values to aggregate. To get meaningful charts, construct your queries to return the specific values you want to see visualized. Here are some sample queries and the resulting charts.

Example chart: Alerts by severity

Use the summarize operator to get a numeric count of the values you want to chart. The following query uses the summarize operator to count the number ofcounts alerts by severity.severity so you can visualize their distribution:

AlertInfo

:::image type="content" source="./media/advanced-hunting-query-results/advanced-hunting-column-chart-new.png" alt-text="An example of a chart that displays advanced hunting results in the Microsoft Defender portal" lightbox="./media/advanced-hunting-query-results/advanced-hunting-column-chart-new.png":::

<a name="phishing-emails-across-top-ten-sender-domains"></a>
#### Example chart: Phishing emails across top ten sender domains

If you're dealing with a list of values that isn't finite, use the `top` operator, which returns only the highest-ranking rows by a specified column, to chart the values with the most instances. For example, to getthe following query summarizes phishing-related email events by sender domain and returns the top 10 sender domains with the most phishing emails, use the following query:common sources:

```kusto
EmailEvents
:::image type="content" source="./media/advanced-hunting-query-results/advanced-hunting-pie-chart-new.png" alt-text="The pie chart that displays advanced hunting results in the Microsoft Defender portal" lightbox="./media/advanced-hunting-query-results/advanced-hunting-pie-chart-new.png":::


<a name="file-activities-over-time"></a>
#### Example chart: File activities over time
By using the `summarize` operator with the `bin()` function, you can check for events involving a particular indicator over time. The following query countssearches across cloud app and device file events for activity involving the file `invoice.doc`, counting matches at 30-minute intervals to show spikes in activity related to that file:activity:

```kusto
CloudAppEvents

:::image type="content" source="./media/advanced-hunting-query-results/add-filter3.png" alt-text="Screenshot of new filter pill in advanced hunting." lightbox="./media/advanced-hunting-query-results/add-filter3.png":::

This selectionSelecting the newly added filter opens a dropdown showing the possible filters you can use. Select one or more of the check boxes, and then select **Apply**.

:::image type="content" source="./media/advanced-hunting-query-results/add-filter4.png" alt-text="Screenshot of new filter's dropdown in advanced hunting." lightbox="./media/advanced-hunting-query-results/add-filter4.png":::


By default, a timeline appears above the advanced hunting results that displays event counts over time. The timeline automatically renders based on the `Timestamp` or `timeGenerated` column in the query results. It automatically updates when you apply filters and can help you quickly identify abnormal behavior and trends and focus on interesting results.
:::image type="content" source="./media/advanced-hunting-query-results/advanced-hunting-query-results-timeline.png" alt-text="Screenshot of the timeline above the query results in advanced hunting." lightbox="./media/advanced-hunting-query-results/advanced-hunting-query-results-timeline.png":::

You can select whether to display the timeline by default in the **Chart preferences** settings.
- Your results include a `Timestamp` or `timeGenerated` column.

<a name="related-topics"></a>
## See also

- [Advanced hunting overview](advanced-hunting-overview.md)
- [Learn the query language](advanced-hunting-query-language.md)

:::image type="content" source="./media/advanced-hunting-query-results/advanced-hunting-query-results-timeline.png" alt-text="Screenshot of the timeline above the query results in advanced hunting." lightbox="./media/advanced-hunting-query-results/advanced-hunting-query-results-timeline.png":::

You can select whether to display the timeline by default in the Chart preferences settings.

  • Your results include a Timestamp or timeGenerated column.

Related content