4. Perform Threat Hunting (20–25%)
Detections answer questions you already know to ask; hunting finds the answers to questions you haven't encoded yet. This phase covers the hunter's toolkit in the order a hunt usually unfolds. You start in Defender XDR's advanced hunting, choosing the right tables and writing KQL that isolates suspicious behavior, informed by threat analytics reports about what attackers are doing now (4.1). You then switch from rows to relationships, using hunting graphs and the Sentinel graph to see how far an attacker could reach (4.2). Finally, you hunt at scale and over long time ranges in the Sentinel platform with hunting queries, KQL jobs, summary rules, notebooks, and the MCP server (4.3). Every hunt should end the same way Phase 1 described: anything valuable you find becomes a detection, so you never have to hunt for it by hand again.
Why care: hunting questions test whether you pick the right data source and tool for the time range and scale. Think of a detective who first chooses which archive to search before deciding how to search it.
⚠️ Exam Trap: Advanced hunting covers 30 days of XDR data, hunting queries don't alert on their own, and the incident graph isn't the blast radius. Each of these appears as a confident-sounding wrong answer.
