-Security analysts use hunting queries at the heart of the threat hunting process in Microsoft Sentinel. They write advanced, customizable queries in Kusto Query Language (KQL) to sift through large volumes of data collected from various sources. These queries allow analysts to identify potential security threats, investigate suspicious activities, and gain insights into the behavior of their network and endpoints. In Microsoft Sentinel, analysts proactively search for threats that might have bypassed existing security defenses. This proactive approach helps analysts uncover hidden threats, patterns, or anomalies within their IT environment. Hypotheses about potential threats or the latest intelligence on emerging attack vectors typically drive the hunting process. For more information, see [Threat hunting in Microsoft Sentinel | Microsoft Learn](/azure/sentinel/hunting)
0 commit comments