Domain 4 of 4 · Chapter 2 of 3

Hunt for Threats by Using Microsoft Sentinel

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Security Operations Analyst Associate premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Hunting vs detection: two paths over one set of logs
  • MITRE ATT&CK coverage analysis
  • Threat indicators: manage and pivot on IOCs
  • Hunts, hunting queries, and bookmarks
  • Reach old or cheap data: search jobs and archive restore
  • Exam-pattern recognition

Which Microsoft Sentinel hunting tool to reach for

ToolWhat it isWhen to use itKey constraint
Hunting queryA saved KQL query you run on demand against workspace tablesTest a technique hypothesis proactively, with no incident requiredRuns over live, interactive-retention data only
HuntA structured container grouping queries, findings, and collaborators around one hypothesisOrganize a multi-query investigation and track it to a conclusionOrganizational container; it does not itself query data
BookmarkA preserved query row with notes and mapped entitiesCapture and keep a single interesting finding mid-huntStored in HuntingBookmark; promote to an incident to action it
Threat indicatorAn IOC (IP, domain, URL, hash) in ThreatIntelligenceIndicatorPivot logs against known-bad observables, or drive a matching ruleHas confidence and expiration; stale IOCs age out
Search jobAn async KQL search over Basic/Auxiliary or long-term-retention dataQuery high-volume or aged data the live engine will not scanAsynchronous; writes results to a new _SRCH table

Decision tree

Data outside interactive tier?archived, or Basic/AuxiliaryNeed joins / full KQL?over the aged dataYesWhat is the goal?on live, interactive dataNoRestore (_RST)full interactive KQLYesSearch job (_SRCH)async, single tableNoThreat indicatormatch known IOCMatch IOCMITRE matrixsee coverage gapsSee gapsBookmarkpreserve a found rowKeep a rowHunting queryproactive, inside a huntSearch proactively
Cheat sheet

Cheat sheet

  • Hunting is proactive search; it does not create incidents by itself
  • Promote a proven hunting query into an analytics rule to automate it
  • Use the MITRE ATT&CK page to find techniques you have no coverage for
  • Only tagged rules and queries paint the MITRE coverage matrix
  • Threat indicators are IOCs stored in ThreatIntelligenceIndicator
  • Bring indicators in via TAXII, the upload connector/API, or manual entry
  • Let the Microsoft Defender Threat Intelligence Analytics rule match IOCs automatically
  • A hunt is the investigation; a hunting query is the tool inside it
  • Bookmarks preserve a single query row so a finding survives
  • Add a bookmark to an incident to move from hunting into response
  • Favorite a hunting query to run it automatically on the Hunting page
  • Normal hunting queries see only interactive-tier data in its retention window
  • Run a search job to scan archived or low-cost-tier data asynchronously
  • Restore an archived table when you need full interactive KQL over aged data
  • Interactive retention can run up to two years, archive up to twelve
  • Match the question's intent to the right hunting tool
  • A bookmark needs at least one mapped entity to appear in the investigation graph
  • A hunt's Entities tab is populated only from the bookmarks' entity mappings
  • Tag bookmarks to classify them so a campaign's findings can be filtered together
  • The MITRE ATT&CK matrix shows active scheduled and NRT rules by default, never disabled rules
  • Simulated coverage = detections that are available but not yet configured, not hunting queries you ran
  • A log-data restore must span a time range of at least two days
  • Editing a data-lake KQL job is allowed only if the query keeps the same output schema

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. Hunting capabilities in Microsoft Sentinel
  2. Advanced hunting overview in Microsoft Defender XDR
  3. View MITRE ATT&CK coverage in Microsoft Sentinel
  4. Threat intelligence
  5. Conduct end-to-end threat hunting with Hunts
  6. Hunt with bookmarks in Microsoft Sentinel
  7. Configure interactive and long-term data retention in Microsoft Sentinel
  8. Search for specific events across large datasets in Microsoft Sentinel
  9. Restore archived logs from search