Domain 3 of 3 · Chapter 2 of 2

Detect threats by using the Microsoft Sentinel platform

Unlock the complete study guide + 25 practice exams totaling 1,498 questions.

Bundled into the existing Microsoft Certified: Security Operations Analyst Associate premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Four tools for hunting on the Sentinel platform
  • The Hunting page and its query list
  • Creating, cloning, and editing hunting queries
  • Bookmarks: keeping evidence from a hunt
  • Hunts: working one hypothesis end to end
  • Turning a hunting lead into action
  • Data lake prerequisites for jobs and notebooks
  • Choosing between KQL jobs, summary rules, and search jobs
  • Creating a KQL job
  • Writing KQL job queries for the data lake
  • Hunting patterns that suit KQL jobs
  • Running and maintaining KQL jobs
  • Summary rules: bins and timing
  • Writing an efficient summary rule query
  • Deploying summary rules from the wizard or a template
  • What summary rules cost
  • Keeping summary rules healthy
  • Notebooks: two runtimes for code-driven hunting
  • Starting and monitoring a data lake notebook session
  • Reading and writing lake tables with MicrosoftSentinelProvider
  • Notebook jobs and runtime limits
  • Connecting the Sentinel MCP server in VS Code
  • Hunting with the data exploration tools
  • Practice: matching hunting requirements to Sentinel features

The four Sentinel hunting tools at a glance

AspectHunting queriesKQL jobsSummary rulesNotebooks
LanguageKQLKQL without adx(), arg(), externaldata(), ingestion_time(), or user-defined functionsKQL without cross-resource expressions, schema-reshaping plugins, or user-defined functionsPython (PySpark in the data lake runtime)
Data readWorkspace log tables, opened in the Logs pageData lake and federated tables across the selected workspacesTables on the Analytics, Basic, or Auxiliary plan, and data lake tables except System tablesData lake and federated tables, plus external data your code can reach
When it runsWhen you run it; favorites run each time the Hunting page opensOnce on submit, or on a schedule that starts at least 30 minutes outOnce per bin (20 to 1440 minutes) over recent incoming dataInteractively, or on a schedule as a notebook job
What it leaves behindA result count; bookmarks keep chosen rowsOne table: new analytics tables end in _KQL_CL, new lake tables in _KQLA custom _CL table on the Analytics planTables saved with save_as_table (_SPRK lake, _SPRK_CL analytics)
Where you author itHunting page, Queries tabKQL queries editor or Jobs page in the Defender portalSummary rules page, API, or Azure Resource Manager templateVS Code Sentinel extension (data lake); Notebooks page (classic)
Raises alertsNo; New alert rule creates an analytics ruleNo; results land in a tableNo; add an analytics rule over the tableNo; results land in a table or the notebook

Decision tree

Must it alert withnobody watching?YesAnalyticsruleNoDoes the analysisneed Python code?YesNotebooksPython codeNoInteractive huntfor leads right now?YesHuntingqueriesNoAggregate recenthigh-volume logs?YesSummaryrulesNoKQL jobsyears of history
Cheat sheet

Cheat sheet

  • Custom hunting queries carry entity and MITRE ATT&CK mappings
  • Only custom-source hunting queries can be edited directly in the hunting list
  • Results delta highlights changes between adjacent daily windows
  • An N/A hunting result can indicate missing data-source prerequisites
  • Favorite queries run when the Hunting page is accessed
  • A validated hunting query can become a Sentinel analytics rule
  • The hunting tactic bar counts queries remaining after filtering
  • Installing hunting content makes reusable queries available for evaluation
  • A hunt organizes queries and evidence around a hypothesis
  • A bookmark preserves a result row and its generating query
  • Bookmarks belong to Sentinel-specific Hunting rather than unified Advanced hunting
  • HuntingBookmark lets saved findings participate in KQL analysis
  • Bookmarks can be escalated into new or existing incidents
  • Hunt findings support indicator creation and entity-focused investigation
  • The September 2026 onboarding change affects custom lake analytics authoring
  • KQL jobs persist one-time and recurring lake investigations
  • KQL jobs can read federated data but cannot write results to federated tables
  • Analytics table creation requires permission for the data lake managed identity
  • Appending job results requires the destination schema to match
  • Source workspace selection is independent of the output workspace
  • Preserve historical event time separately during analytics promotion
  • Interactive KQL is not automatically portable to a native data lake job
  • Stored query results require the job time range in KQL text
  • Selective promotion balances repeat-query savings against Analytics storage cost
  • Retrospective anomaly hunts compare recent behavior with an entity-specific baseline
  • Potential beaconing is revealed by recurring communication intervals and their prevalence
  • Scheduled KQL jobs require at least 30 minutes of start-time lead
  • Lake jobs must account for typical ingestion latency of up to 15 minutes
  • KQL job concurrency is a tenant-wide quota separate from interactive queries
  • A one-hour KQL job timeout can leave partial promoted results
  • Editing a one-time KQL job immediately triggers execution
  • Disabling a KQL job does not cancel a run already in progress
  • KQL job templates prefill settings but still require a destination workspace
  • Summary rules precompute reusable aggregations into Analytics-plan custom tables
  • Bin size defines summary cadence and the aggregation interval
  • Bin delay postpones aggregation for delayed source data
  • Summary rules process incoming data rather than arbitrary historical intervals
  • Summary query support depends on the source table plan
  • Summary processing includes applicable query and ingestion charges
  • Alerting over summary data requires a separate analytics rule
  • An installed summary template must still be created and saved as a rule
  • Shareable summaries should retain investigation keys while minimizing sensitive detail
  • Threat-intelligence enrichment requires structured observables before matching
  • SummaryLogs diagnostics preserve summary execution history
  • Summary output schemas do not dynamically expand during normal runs
  • Removing query fields does not erase existing summary columns or data
  • Retrying a summary bin requires a valid aligned start time
  • Wait for provisioningState Succeeded before another summary-rule change
  • Reduce bin size when summary aggregation approaches query limits
  • Notebooks combine executable analysis with investigation narrative
  • MicrosoftSentinelProvider exposes lake tables to Spark notebooks
  • Match notebook runtime pools to workload complexity
  • Changing the Sentinel extension account disconnects active PySpark sessions
  • Native lake notebooks do not support arbitrary pip installations
  • Author and update notebook jobs through the Sentinel VS Code extension
  • Notebook jobs have different execution and concurrency limits from KQL jobs
  • The Sentinel kernel starts Spark and exposes session-specific diagnostics
  • Notebook variables and saved intermediate evidence make investigations repeatable
  • Notebook capacity monitoring and session timeout settings address different operating risks
  • The notebook result display does not establish the full dataset size
  • Notebook investigations can add context that is not stored in Sentinel tables
  • Notebook transformations require an explicit persistence step with the intended write mode
  • Add the Sentinel data exploration collection as an HTTP MCP server
  • Verify MCP tools in Agent mode after authentication
  • List available workspaces before directing MCP queries
  • Search_tables discovers relevant tables and schemas from investigative keywords
  • Query_lake runs one KQL query and returns raw investigation results
  • Retrieve entity analysis using the identifier returned at submission
  • User entity analysis requires an Entra identity and core source tables
  • Entity analyzer requires Security Copilot permission and consumes SCUs
  • VS Code hosts the MCP workflow while Sentinel hosts the tool server
  • Choose the MCP collection according to the investigation workflow
  • The Agent creation collection turns described intent into Security Copilot agents

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. https://learn.microsoft.com/en-us/kusto/query/
  2. https://learn.microsoft.com/en-us/azure/sentinel/hunting
  3. https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-jobs
  4. https://learn.microsoft.com/en-us/azure/sentinel/summary-rules
  5. https://learn.microsoft.com/en-us/azure/sentinel/notebooks
  6. https://learn.microsoft.com/en-us/azure/sentinel/manage-data-overview
  7. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-table-plans
  8. https://learn.microsoft.com/en-us/azure/sentinel/manage-table-tiers-retention
  9. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/summary-rules
  10. https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview
  11. https://learn.microsoft.com/en-us/azure/sentinel/hunts
  12. https://learn.microsoft.com/en-us/azure/sentinel/hunts-custom-queries
  13. https://learn.microsoft.com/en-us/azure/sentinel/bookmarks
  14. https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/huntingbookmark
  15. https://learn.microsoft.com/en-us/azure/sentinel/whats-new
  16. https://learn.microsoft.com/en-us/azure/sentinel/roles
  17. https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-jobs-summary-rules-search-jobs
  18. https://learn.microsoft.com/en-us/kusto/management/stored-query-results
  19. https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-sample-queries
  20. https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-manage-jobs
  21. https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/lasummarylogs
  22. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/personal-data-mgmt
  23. https://learn.microsoft.com/en-us/azure/sentinel/datalake/notebooks
  24. https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-provider-class-reference
  25. https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-overview
  26. https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-data-exploration-tool
  27. https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-agent-creation-tool
  28. https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-use-tool-visual-studio-code