4.3.1. Hunting Queries
💡 First Principle: A hunting query is a saved, reusable hypothesis. Running a library of them regularly and watching for changes in their results turns hunting from an occasional deep dive into a routine sweep, and results that prove valuable graduate into detections.
In the Defender portal, Sentinel hunting lives under Threat management > Hunting. The Queries tab lists built-in queries installed from Content hub solutions, organized by MITRE tactic and technique, plus custom queries you create, clone, or share. Each query shows its data sources (queries missing a required source are flagged), tactics, and results.
Monitoring hunting queries means watching their results over time:
- Run all queries (or a selection) to refresh results across the library.
- Results count shows how many rows each query returns; N/A means the query is inactive in your environment.
- Results delta and delta percentage compare the last 24 hours with the previous 24 to 48 hours, highlighting spikes worth investigating.
- Favorites run automatically whenever you open the Hunting page.
- The MITRE tactic bar updates with your filters, showing where hunting coverage is concentrated.
Hunts (preview) add structure: create a hunt from selected queries, record a hypothesis, investigate, and track whether it was validated, with linked incidents and rules visible in one place. Bookmarks preserve interesting result rows with notes, tags, and entity mappings; they can be added to incidents or used to create incidents, and they're stored in the HuntingBookmark table (bookmarks are part of the Sentinel hunting experience, not the unified advanced hunting page). Livestream sessions are retired; continuous watching is now done with analytics rules, custom detections, or KQL jobs.
Microsoft's recommended cadence: run relevant queries at least weekly in normal times, actively during a compromise, and afterward refine them and turn the high-value ones into detections. From a query's results, New alert rule > Create Microsoft Sentinel alert opens the analytics rule wizard with the query prefilled.
⚠️ Exam Trap: "Ensure you're notified automatically whenever a hunting query's pattern recurs" requires creating an analytics rule (or custom detection) from the query. Marking it a favorite only reruns it when you open the page, and livestream is no longer available.
Reflection Question: A hunting query's results delta jumps 400% overnight. What are three possible explanations, only one of which is an attack, and how would you tell them apart?
