Microsoft Defender XDR

Microsoft Security Copilot advanced hunting query assistant

4 September 2026Doc update+13 / −11 lines

In brief

The page now refers to Security Copilot’s Threat Hunting Assistant and explains how to run a generated query, add it to the editor for review, and view its logic. Screenshots, image descriptions, feedback wording, and the page date were also updated.

What Defender admins need to know

Administrators get refreshed instructions for reviewing and running generated queries. No administrator action is specified.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Microsoft Security Copilot advanced hunting query assistant description: Learn how Microsoft Security Copilot ~~threat hunting agent~~Threat Hunting Assistant can help you generate a KQL query. ms.service: defender-xdr ms.subservice: adv-hunting ms.author: pauloliveria

cx-ti
cx-ah ms.topic: how-to ms.date: ~~06/16/~~07/02/2026 appliesto:
Microsoft Defender
Microsoft Defender XDR

Copilot generates a KQL query from your text instruction or question. While Copilot is generating, you can cancel the query generation by selecting Stop generating.
Review the generated query. To check how Copilot came up with the query, you can select See the logic behind the query below the query text to expand the explanation behind the query. Select itSee the logic behind the query again to ~~minimize.~~minimize the explanation.

You can then choose to run the query by selecting Run query.

The generated query appears as the last query in the query editor and runs automatically.

The generated query appears in the query editor as the last query, where you can edit it before running using the regular Run query above the query editor.
You can provide feedback about the generated response by selecting the feedback icon and choosing Looks right, Needs improvement, or Inappropriate.

Run or add the generated query

When the Threat Hunting Assistant generates a KQL query, select Run query to run it in advanced hunting.

To review or edit the query before running it, select the arrow next to Run query, then select Add to editor. The query is added to the query editor without running.

Screenshot of the Run query split button in the Security Copilot side pane, showing the Add to editor option.

To see how the query was constructed, select See the logic behind the query.

@@ -1,6 +1,6 @@ --- title: Microsoft Security Copilot advanced hunting query assistant-description: Learn how Microsoft Security Copilot threat hunting agent can help you generate a KQL query.+description: Learn how Microsoft Security Copilot Threat Hunting Assistant can help you generate a KQL query. ms.service: defender-xdr ms.subservice: adv-hunting ms.author: pauloliveria@@ -16,7 +16,7 @@ ms.custom: - cx-ti - cx-ah ms.topic: how-to-ms.date: 06/16/2026+ms.date: 07/02/2026 appliesto: - Microsoft Defender - Microsoft Defender XDR@@ -58,16 +58,16 @@ To start using the Query assistant, follow these steps:  1. Copilot generates a KQL query from your text instruction or question. While Copilot is generating, you can cancel the query generation by selecting **Stop generating**. -    ![Screenshot of Security Copilot in advanced hunting generating a response.](./media/advanced-hunting-security-copilot/advanced-hunting-security-copilot-generate.png)+    ![Screenshot of Security Copilot in advanced hunting showing generated query results with Add and run and Add to editor options.](./media/advanced-hunting-security-copilot/advanced-hunting-security-copilot-generate.png)  -1. Review the generated query. To check how Copilot came up with the query, you can select **See the logic behind the query** below the query text to expand the explanation behind the query. Select it again to minimize.+1. Review the generated query. To check how Copilot came up with the query, you can select **See the logic behind the query** below the query text to expand the explanation behind the query. Select **See the logic behind the query** again to minimize the explanation. -   ![Screenshot of Copilot button showing See the logic behind the query.](./media/advanced-hunting-security-copilot/advanced-hunting-security-copilot-see-logic.png)+   ![Screenshot of Security Copilot option to see the logic behind the query.](./media/advanced-hunting-security-copilot/advanced-hunting-security-copilot-see-logic.png)       You can then choose to run the query by selecting **Run query**. -   ![Screenshot of Copilot button showing Run query option.](./media/advanced-hunting-security-copilot/advanced-hunting-security-copilot-run-query.png)+   ![Screenshot of Security Copilot showing the Run query option.](./media/advanced-hunting-security-copilot/advanced-hunting-security-copilot-run-query.png)      The generated query appears as the last query in the query editor and runs automatically. @@ -78,17 +78,19 @@ To start using the Query assistant, follow these steps:     The generated query appears in the query editor as the last query, where you can edit it before running using the regular **Run query** above the query editor.  -1. You can provide feedback about the generated response by selecting the feedback icon ![Screenshot of the feedback icon in Security Copilot for advanced hunting.](./media/advanced-hunting-security-copilot/advanced-hunting-security-copilot-feedback-icon.png) and choosing **Looks right**, **Needs improvement**, or **Inappropriate**.+1. You can provide feedback about the generated response by selecting the feedback icon ![Screenshot of Security Copilot feedback option in advanced hunting.](./media/advanced-hunting-security-copilot/advanced-hunting-security-copilot-feedback-icon.png) and choosing **Looks right**, **Needs improvement**, or **Inappropriate**.   > [!TIP] > Providing feedback is an important way to let the Security Copilot team know how well the query assistant was able to help in generating a useful KQL query. Feel free to articulate what could make the query better, what adjustments you had to make before running the generated KQL query, or share the KQL query that you eventually used.  -## Modify settings+## Run or add the generated query -Select the three-dot menu in the Copilot side pane to choose whether to automatically add and run the generated query in advanced hunting.+When the Threat Hunting Assistant generates a KQL query, select **Run query** to run it in advanced hunting. -   ![Screenshot of Security Copilot in advanced hunting showing the settings three-dot menu icon.](./media/advanced-hunting-security-copilot/advanced-hunting-security-copilot-settings.png)+To review or edit the query before running it, select the arrow next to **Run query**, then select **Add to editor**. The query is added to the query editor without running. -If you deselect the **Run generated query automatically** setting, you can choose to run the generated query automatically (**Add and run**) or add the generated query to the query editor for further modification (**Add to editor**).+   ![Screenshot of the Run query split button in the Security Copilot side pane, showing the Add to editor option.](./media/advanced-hunting-security-copilot/advanced-hunting-security-copilot-settings.png)++To see how the query was constructed, select **See the logic behind the query**.