capability

Advanced Hunting

Advanced hunting is a query-based threat hunting capability in Microsoft Defender XDR that uses KQL to inspect raw event data across supported Microsoft security products.

capabilitiesCurrent

Relationships

Microsoft Defender for Endpoint
Source productproductMicrosoft Defender for Endpoint P2
Required licenselicenseDeviceProcessEvents
Related tabletableDeviceEvents
Related tabletableDeviceFileEvents
Related tabletableDeviceNetworkEvents
Related tabletableDeviceRegistryEvents
Related tabletableDeviceLogonEvents
Related tabletableDeviceImageLoadEvents
Related tabletableDeviceInfo
Related tabletableThreatIntelIndicators
Related tabletableThreatIntelObjects
Related tabletableMicrosoft Graph Security API
API accessapiMicrosoft Defender for Endpoint APIs
API accessapiLegacy Microsoft Defender XDR APIs
API accessapi

Configuration Methods

MethodSupportReference or Gap
PortalSupported Reference
PowerShellGapNo product-specific PowerShell automation surface is recorded for this capability yet.
REST APISupported Reference
GraphSupported Reference
ARMGapNo ARM resource is recorded for this capability.
BicepGapNo Bicep resource is recorded for this capability.
TerraformGapAdvanced hunting is a query capability, not a desired-state resource. Automate saved queries or query execution through Graph/REST scripts.
GitHub ActionsSupported Reference
Azure DevOpsSupported Reference