Detect threats by using Microsoft Defender XDR

• DeviceProcessEvents is the source for process creation investigations
• Connection activity and network configuration require different tables
• DeviceFileEvents records file creation and modification
• DeviceRegistryEvents exposes registry entry creation and modification
• DeviceLogonEvents provides device authentication activity
• DeviceEvents includes activity generated by endpoint security controls
• DeviceFileCertificateInfo provides signed-file certificate evidence
• Device vulnerability observations and vulnerability knowledge are separate datasets
• Configuration assessment status and configuration definitions occupy separate tables
• Software evidence locates the artifacts supporting a detected installation
• DeviceTvmInfoGathering pairs attack-surface observations with assessment metadata
• DeviceTvmHardwareFirmware supplies hardware and firmware inventory evidence
• Browser-extension installations and extension permissions require complementary sources
• DeviceTvmCertificateInfo supplies device certificate inventory
• Baseline compliance hunts separate device snapshots, configuration definitions, and monitored profiles
• AlertInfo describes alerts while AlertEvidence identifies their associated entities
• EmailPostDeliveryEvents tracks security events after message delivery
• EmailUrlInfo identifies embedded URLs while UrlClickEvents records Safe Links clicks
• EmailAttachmentInfo is the attachment metadata source for email hunts
• IdentityQueryEvents captures queries for Active Directory objects
• Entra user sign-ins and service-principal sign-ins use separate hunting tables
• CloudAppEvents supplies activity involving accounts and cloud application objects
• BehaviorInfo and BehaviorEntities separate behavior records from involved entities
• Teams message investigations use message-specific tables
• Exposure graph KQL queries separate entity properties from relationship evidence
• Cloud infrastructure audit and DNS hunts use dedicated telemetry tables
• Purview activity violations and suspicious-behavior insights use different tables
• CampaignInfo supplies the campaign context behind related email messages
• FileMaliciousContentInfo supplies collaboration-file evidence outside email attachments
• OAuthAppInfo describes connected applications rather than their operation history
• IdentityAccountInfo connects account context to the owning identity
• MessageContents supplies Teams message snippets for content-focused hunts
• CallActivityEvents is the hunting source for activity during Teams calls
• Cloud runtime hunts distinguish process execution from storage activity
• CloudPolicyEnforcementEvents explains security-gating outcomes
• AgentsInfo describes AI agents as investigation entities
• IdentityEvents extends identity-event hunting beyond Entra-specific sign-ins
• Disruption-event hunts require disruption telemetry rather than process history
• GraphAPIAuditEvents is the Advanced hunting source for Microsoft Graph requests
• KQL hunting time filters use UTC regardless of display timezone
• Use has for whole terms and contains for substrings
• Case-sensitive equality and case-insensitive equality are different KQL choices
• Summarize groups events before an aggregate threshold is evaluated
• Extend adds calculated columns while project controls the returned schema
• Top selects ordered results while limit only caps the row count
• Make_set retains distinct evidence values within each summarized group
• Typed literals and conversions keep hunting predicates aligned with column types
• Has_any finds any listed term inside a command line
• Let bindings parameterize hunts while semicolons separate statements
• Case-insensitive value operators do not relax KQL identifier casing
• KQL pipelines transform intermediate results without rewriting their source data
• Union combines event streams while join matches related records
• Use an inner join when every matching left-side event must survive
• A shared entity key does not establish that two events belong to the same sequence
• Process IDs alone cannot uniquely identify an execution instance
• Reduce the event set before parsing or transforming strings
• Choose join distribution strategies based on input size and key cardinality
• Find discovers predicate matches across tables before a hunt is narrowed
• ADX cross-resource hunting is supported from Sentinel hunting and Log Analytics
• The in-portal schema reference explains valid table fields and event types
• The cursor selects which separated query runs in the hunting editor
• The query resources report identifies costly and throttled hunting activity
• Organization-wide query resource visibility requires Security Reader or higher
• Command-line hunts should tolerate irrelevant formatting and argument order
• Guided hunting builds queries visually while advanced mode accepts authored KQL
• A hunting result below the row cap can still be truncated by size
• Hunting events arrive after transmission while entity context refreshes hourly
• Email metadata hunting requires a different URBAC permission from alert reading
• A historical hunt is meaningful only within its source's searchable window
• Shared hunting logic provides a starting point rather than a finished local investigation
• High-impact threats and highest-exposure threats answer different prioritization questions
• The Analyst report provides attack-chain context and hunting guidance
• Impacted assets distinguishes affected entities from alert totals
• Endpoints exposure shows weaknesses rather than proof of compromise
• Threat analytics recommended actions cover Secure Score-tracked recommendations
• Not available can mean a threat report lacks linked assessment data
• Reading threat reports does not automatically expose every product's organizational evidence
• The Indicators tab retains expired IOCs for retrospective investigation
• Alerts over time reveals progress in resolving a threat's alerts
• Threat tags select subject matter while categories select report types
• Related incidents connects a tracked threat to organizational response records
• The Threat Intelligence Briefing Agent adds organizational relevance to threat reporting
• Predefined hunting scenarios render graphs from a scenario and its inputs
• Entity relationship map explores a seed entity's direct connections
• Attack paths to critical asset starts from the asset to identify possible routes
• Access to key vaults reveals direct and indirect paths to a selected vault
• Choose storage-access scenarios according to the known starting entity
• Choke points to SQL data stores identifies nodes shared by many access paths
• Identity graph scenarios distinguish application privilege from directory escalation
• Graph filters constrain node properties, edge types, and direction
• Blast radius combines observed incident context with possible future reach
• The initial blast radius view displays eight top-rated attack paths
• Permissions can remove paths containing out-of-scope entities
• Missing workloads and undefined critical assets reduce blast radius coverage
• Blast radius is limited by data freshness and modeled attack vectors
• Sentinel graph expresses security context as nodes and typed relationships
• Custom graph analysis uses Graph Query Language and a node-edge schema
• Publish a graph job for continued access after notebook analysis
• The MCP path-discovery tool evaluates connections for lateral movement
• Custom graphs connect evidence across Sentinel and non-Microsoft data
• Custom graph authoring hands off from Sentinel notebooks to the Defender Graphs page

Unlock with Premium — includes all practice exams and the complete study guide.