Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
Hunting and detection

Use custom functions in advanced hunting

4 September 2026Doc update+9 / −9 lines

In brief

The page title, publication date, screenshot descriptions, parameter wording, tabular-parameter text, and the “See also” heading were revised.

What Defender admins need to know

Clearer screenshots and wording make it easier to identify function categories, create reusable functions, define parameters, delete functions, and find related content.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Advanced hunting includes three different types of functions:

Screenshot of advanced hunting functions pane showing Built-in functions, Shared functions, and My functions categories.

  • Built-in functions – Prebuilt functions included with Microsoft Defender advanced hunting. All advanced hunting instances provide these functions, and you can't modify them.
  • Shared functions – Custom functions that users create. All users in a specific tenant can access these functions. Users can modify and control these functions. In the Advanced hunting query editor, after composing a query, create a function from it as follows:

  1. Select Save and then Save as function. Screenshot of the Save menu showing where to select Save as function to create a reusable custom function.

  2. In the Save as function flyout panel, provide the following information:

    • Description - A description that helps other users understand the purpose of the function and how it works.
    • Parameters - Add a parameter for each variable in the function that requires a value when it's used. For more information, see Add parameters to your custom function.

    Screenshot of the Save as function panel used to define a custom function's name, storage location, description, and parameters.

  3. Select Save.

Add parameters to your custom function

Add parameters to a function so you can provide the arguments or values for certain variables when calling the function. By using this feature,parameters, you can use the same function in different queries, each with different values for the parameters.

To add parameters when saving your custom function, select Add parameter, and then enter the following properties:

  • Type - Data type for the value

Create custom functions with tabular parameters

Create custom functions that use tabular parameters. By using tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries. This capabilityUsing tabular parameters is especially useful for complex hunting scenarios that require structured data inputs.

To create tabular parameters for your custom function:

  1. Select Add parameter and then choose table as its Type.

To delete a function, select the three dots to the right of the function and select Delete.

Screenshot of the function context menu with the Delete option for a custom function.

See alsoRelated content