Daily Defender News
Aboutmerill.net
Microsoft Unified SecOps Platform
Hunting and detection

Hunting Overview

4 September 2026Doc update+2 / −2 lines

In brief

The overview replaces the Infrastructure chaining entry with a Threat analytics link for tracking emerging threats and reviewing Microsoft threat research and insights. The reactive hunting table formatting was also adjusted.

What Defender admins need to know

Administrators looking for threat research from the hunting overview should use the new Threat analytics link; no configuration changes are required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

|MITRE ATT&CK map | When creating a new hunting query, select specific tactics and techniques to apply.| |Restore historical data | Restore data from archived logs to use in high performing queries. | |Search large data sets | Search for specific events in logs up to seven years ago using KQL. | |Infrastructure chaining Threat analytics | Hunt for new connections betweenTrack emerging threats and review Microsoft threat actors, group similar attack activityresearch and substantiate assumptions.insights. | |Threat explorer | Hunt for specialized threats related to email. |

Hunting stages

Hunting stage Hunting tools
Proactive - Find the weak areas in your environment before threat actors do. Detect suspicious activity extra early. - Regularly conduct end-to-end hunts to proactively seek out undetected threats and malicious behaviors, validate hypotheses, and act on findings by creating new detections, incidents, or threat intelligence.

- Use the MITRE ATT&CK map to identify detection gaps, and then run predefined hunting queries for highlighted techniques.

- Insert new threat intelligence into proven queries to tune detections and confirm if a compromise is in process.

- Take proactive steps to build and test queries against data from new or updated sources.

- Use advanced hunting to find early-stage attacks or threats that don't have alerts.
Reactive - Use hunting tools during an active investigation. - Use livestream to run specific queries at consistent intervals to actively monitor events.

- Quickly pivot on incidents with the Go hunt button to search broadly for suspicious entities found during an investigation.

- Hunt through threat intelligenceUse threat analytics to perform infrastructure chaining.investigate emerging threats and assess their potential impact.

- Use Security Copilot in advanced hunting to generate queries at machine speed and scale.
Post incident - Improve coverage and insights to prevent similar incidents from recurring. - Turn successful hunting queries into new analytics and detection rules, or refine existing ones.

- Restore historical data and search large datasets for specialized hunting as part of full incident investigations.