4.1. Hunt with Advanced Hunting in Defender XDR

💡 First Principle: A hunt is a hypothesis tested against data: "if an attacker were doing X here, table Y would show pattern Z." Advanced hunting gives you 30 days of raw Defender XDR telemetry, plus connected Sentinel tables, in one KQL interface. Success depends on three choices: the right hypothesis (often from threat intelligence), the right table, and a query precise enough to separate the attacker from normal business.

Why care: advanced hunting is the most KQL-heavy part of the exam, and hotspot items often show a nearly complete query with blanks for the table, operator, or aggregation. Beyond the exam, it's how you answer questions no alert asked: "Did this new malware family touch us?" "Who else received email from this sender?" "Which devices ran this command line?"

The mental model is a library with specialized reference sections. Each table is a section devoted to one kind of record (processes, network connections, email, logons). A good hunter walks straight to the right section, pulls the right volumes (filters), and cross-references between sections (joins) only when the question requires it.

⚠️ Common Misconception: "DeviceEvents is the right table for any endpoint question." Endpoint telemetry is split by activity: process creation, network, file, logon, registry, and image loads each have their own table, and DeviceEvents holds miscellaneous events. Two more traps: advanced hunting doesn't reach back months by default (30 days of XDR data), and threat analytics reports aren't generic news; they show your organization's own impacted assets and exposure.