4.4. Reflection Checkpoint

Key Takeaways

• Translate the hunt's verb into a table: processes, network, files, logons, registry, and image loads each have their own Device* table; email, clicks, identity, cloud app, and alert activity have theirs. Filter on time and ActionType early, use initiating-process columns to find causes, and remember XDR data covers 30 days.
• Build queries that narrow fast and join carefully (let, explicit join kind, time windows after joins, arg_max for latest per entity), stay within advanced hunting limits, and convert valuable queries into custom detections. Threat analytics supplies hypotheses and your organization's own impacted assets and exposure.
• Graphs answer reachability: the incident graph shows what an attacker did, while hunting graph scenarios and the Sentinel graph show what they could reach. Use entity relationship maps for blast radius and choke-point scenarios to find the fixes that remove the most attack paths.
• In the Sentinel platform, hunting queries are monitored by results and deltas and promoted to analytics rules to alert (livestream is retired); KQL jobs promote lake data to working tables; summary rules condense high-volume data into cheap, fast aggregates; notebooks bring Python and Spark to the lake; and the MCP server gives AI agents governed, identity-bound access to security data.

Connecting Forward

Phase 5 turns everything into exam performance: strategy for Microsoft's question formats and case studies, quick-reference tables that compress all three domains for final revision, and mixed practice questions written in exam voice with full rationales.

Self-Check Questions

• A threat analytics report describes attackers using certutil.exe to download payloads. Outline a hunting query (table, filters, projected columns), explain how you'd confirm a hit is malicious, and describe how the query becomes a detection that isolates affected devices automatically.
• Your organization keeps three years of firewall logs in the data lake. Leadership wants (a) a retro-hunt for an IP published today, (b) a fast monthly report of top destinations, and (c) an alert whenever any destination matches active threat intelligence. Map each requirement to a capability and explain why.
• An incident involves a compromised service account. Which graph scenario would you run first, what would you look for in the results, and how would the answer change which assets you contain?