Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Hunting and detection

Hunting Capabilities in Microsoft Sentinel

4 September 2026Doc update+9 / −9 lines

In brief

The hunting documentation was updated with clearer wording for query examples and result-delta metrics, a revised Azure Data Explorer link title, and reorganized custom connector resources.

What Defender admins need to know

Administrators can use the clarified guidance and updated links when reviewing hunting queries and resources; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Hunting capabilitiesCapabilities in Microsoft Sentinel description: Use Microsoft Sentinel's built-in hunting queries to guide you into asking the right questions to find issues in your data. ms.topic: how-to ms.date: 06/15/07/01/2026 ms.author: monaberdugo author: mberdugo ms.reviewer: efratka ms.collection: usx-security ai-usage: ai-assisted ms.custom: msecd-doc-authoring-10141016

#Customer intent: As a security analyst, I want to use advanced threat hunting tools and queries so that I can proactively identify and mitigate security threats across my organization's data sources.

As security analysts and investigators, you want to be proactive about looking for security threats, but your various systems and security appliances generate mountains of data that can be difficult to parse and filter into meaningful events. Microsoft Sentinel has powerful hunting search and query tools to hunt for security threats across your organization's data sources. To help security analysts look proactively for new anomalies that aren't detected by your security apps or even by your scheduled analytics rules, hunting queries guide you into asking the right questions to find issues in the data you already have on your network.

For example, one out of the box query provides data about the most uncommon processes running on your infrastructure. You wouldn't want an alert each time those uncommon processes run. Those processes could be entirely innocent. But you might want to take a look at the uncommon-processes query on occasion to see if there's anything unusual.

[!INCLUDE unified-soc-preview]

Hunting queries

In Microsoft Sentinel in Defender, select Threat management > Hunting, then the Queries tab to run all your queries, or a selected subset. The Queries tab lists all the hunting queries installed with security solutions from the Content hub, and any extra query you created or modified. Each query provides a description of what it hunts for, and what kind of data it runs on. TheseAll hunting queries on the Queries tab are grouped by their MITRE ATT&CK tactics. The icons at the top of the Queries tab categorize the type of threat, such as initial access, persistence, and exfiltration. MITRE ATT&CK techniques are shown in the Techniques column and describe the specific behavior identified by the hunting query.

:::image type="content" source="media/hunting/hunting-start.png" alt-text="Microsoft Sentinel starts hunting" lightbox="media/hunting/hunting-start.png":::

| --------- | --------- | | See how queries apply to your environment | Select the Run all queries button, or select a subset of queries using the check boxes to the left of each row and select the Run selected queries button.

Running your queries can take anywhere from a few seconds to many minutes, depending on how many queries are selected, the time range, and the amount of data that is being queried. | | View the queries that returned results | After your queries are done running, view the queries that returned results using the Results filter:
- Sort to see which queries had the most or fewest results.
- View the queries that aren't at all active in your environment by selecting N/A in the Results filter.
- Hover over the info icon (i) next to the N/A to see which data sources are required to make this query active. | | Identify spikes in your data | Identify spikes in the data by sorting or filtering on Results delta or Results delta percentage.

TheseThe Results delta and Results delta percentage metrics compare the results of the last 24 hours against the results of the previous 24-48 hours, highlighting any large differences or relative difference in volume. | | View queries mapped to the MITRE ATT&CK tactic | The MITRE ATT&CK tactic bar, at the top of the table, lists how many queries are mapped to each MITRE ATT&CK tactic. The tactic bar gets dynamically updated based on the current set of filters applied.

Enables you to see which MITRE ATT&CK tactics show up when you filter by a given result count, a high result delta, N/A results, or any other set of filters. | | View queries mapped to MITRE ATT&CK techniques | Queries can also be mapped to MITRE ATT&CK techniques. You can filter or sort by MITRE ATT&CK techniques using the Technique filter. By opening a query, you're able to select the technique to see the MITRE ATT&CK description of the technique. | | Save a query to your favorites | Queries saved to your favorites automatically run each time the Hunting page is accessed. You can create your own hunting query or clone and customize an existing hunting query template. |

  • Export findings and link them to specific cases for improved SOC collaboration.

You can also create hunting queries over data stored in Azure Data Explorer. For more information, see details of Construct cross-resource queries in the Azure Monitor documentation.

To find more queries and data sources, go to the Content hub in Microsoft Sentinel or refer to community resources like Microsoft Sentinel GitHub repository.

|Links to external data | While Microsoft Sentinel tables have most telemetry and event data, Jupyter Notebooks can link to any data that's accessible over your network or from a file. Using Jupyter Notebooks allows you to include data such as:

- Data in external services that you don't own, such as geolocation data or threat intelligence sources
- Sensitive data that's stored only within your organization, such as human resource databases or lists of high-value assets
- Data that you haven't yet migrated to the cloud. | |Specialized data processing, machine learning, and visualization tools | Jupyter Notebooks provides more visualizations, machine learning libraries, and data processing and transformation features.

For example, use Jupyter Notebooks with the following Python capabilities:
- pandas for data processing, cleanup, and engineering
- Matplotlib, HoloViews, and Plotly for visualization
- NumPy and SciPy for advanced numerical and scientific processing
- scikit-learn for machine learning
- TensorFlow, PyTorch, and Keras for deep learning

Tip: Jupyter Notebooks supports multiple language kernels. Use magics to mix languages within the same notebook, by allowing the execution of individual cells using another language. For example, you can retrieve data using a PowerShell script cell, process the data in Python, and use JavaScript to render a visualization. |

MSTIC, Jupyter, and Python security tools

The Microsoft Threat Intelligence Center (MSTIC) is a team of Microsoft security analysts and engineers who author security detections for several Microsoft platforms and work on threat identification and investigation.