You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-**Built-in functions** – Prebuilt functions included with Microsoft Defender XDR advanced hunting. These functions are available in all advanced hunting instances and can't be modified.
46
46
-**Shared functions** – Custom functions that users create. All users in a specific tenant can access these functions. Users can modify and control these functions.
@@ -51,7 +51,7 @@ There are three different types of functions in advanced hunting:
51
51
To create a function from the current query in the editor:
52
52
53
53
1. Select **Save** and then **Save as function**.
54
-
54
+
55
55
56
56
1. In the **Save as function** flyout panel, provide the following information:
57
57
@@ -60,7 +60,7 @@ To create a function from the current query in the editor:
60
60
-**Description** - A description that helps other users understand the purpose of the function and how it works.
61
61
-**Parameters** - Add a parameter for each variable in the function that requires a value when it's used. For more information, see [Add parameters to your custom function](#add-parameters-to-your-custom-function).
62
62
63
-
63
+
64
64
65
65
1. Select **Save**.
66
66
@@ -84,7 +84,7 @@ To create tabular parameters for your custom function:
84
84
1. Enter a **Name** and **Default value** for the table.
85
85
1. Map each column that your query references to the table. Select **Add column**, then enter the column's properties.
86
86
87
-
87
+
88
88
89
89
> [!NOTE]
90
90
>- You can save a function with more than one table.
@@ -98,21 +98,21 @@ Add a function to the current query by double-clicking on its name or selecting
98
98
99
99
If a query requires arguments, provide them using the following syntax: *function_name(parameter 1, parameter 2, ...)*
100
100
101
-
101
+
102
102
103
103
> [!NOTE]
104
104
> You can't use functions inside another function.
105
105
106
106
## Work with function codes
107
107
You can view the code of a function to understand how it works or to modify its code. Select the three dots to the right of the function and select **Load function code** to open a new tab with the function code.
108
108
109
-
109
+
110
110
111
111
## Edit a custom function
112
112
113
113
Edit the properties of a function by selecting the three dots to the right of the function and selecting **Edit details**. Make any modifications that you want to the properties and parameters of the function, then select **Save**.
114
114
115
-
115
+
116
116
117
117
If the function code is already loaded in the editor, you can also select **Save** to apply any changes to the code or properties of the function.
118
118
@@ -125,7 +125,7 @@ You can delete functions from **My functions** and functions you created in **Sh
125
125
126
126
To delete a function, select the three dots to the right of the function and select **Delete**.
127
127
128
-
128
+
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-query-builder-details.md
+15-15Lines changed: 15 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,58 +38,58 @@ ms.date: 03/28/2025
38
38
Advanced hunting in guided mode supports several data types that you can use to fine-tune your query.
39
39
40
40
- Numbers<br>
41
-
41
+
42
42
43
43
- Strings<br>
44
-
44
+
45
45
46
46
In the free text box, type the value and press **Enter** to add it. Note that the delimiter between values is **Enter**.<br>
47
47
48
-
48
+
49
49
50
50
- Boolean<br>
51
-
51
+
52
52
53
53
54
54
- Datetime<br>
55
-
55
+
56
56
57
57
58
58
- Closed list - You don't need to remember the exact value you're looking for. You can easily choose from a suggested closed list that supports multi-selection.<br>
59
-
59
+
60
60
61
61
62
62
## Use subgroups
63
63
You can create groups of conditions by clicking **Add subgroup**:
67
+
68
68
69
69
## Use smart auto-complete for search
70
70
Smart auto-complete for searching devices and user accounts is supported.
71
71
You don't need to remember the device ID, full device name, or user account name. You can start typing the first few characters of the device or user you're looking for and a suggested list appears from which you can choose what you need:
You can even look for specific event types like all failed logons, file modification events, or successful network connections by using the **EventType** filter in any section where it is applicable.
77
77
78
78
For instance, if you want to add a condition that looks for registry value deletions, you can go to the **Registry Events** section and select **EventType**.
79
79
80
-
80
+
81
81
82
82
Selecting EventType under Registry Events allows you to choose from different registry events, including the one you're hunting for, **RegistryValueDeleted**.
83
83
84
-
84
+
85
85
86
86
> [!NOTE]
87
87
>`EventType` is the equivalent of `ActionType` in the data schema, which users of advanced mode might be more familiar with.
88
88
89
89
## Test your query with a smaller sample size
90
90
If you're still working on your query and would like to see its performance and some sample results quickly, adjust the number of records to return by picking a smaller set through the **Sample size** dropdown menu.
91
91
92
-
92
+
93
93
94
94
The sample size is set to 10,000 results by default, which is the maximum number of records that can be returned in hunting. However, we highly recommend lowering the sample size to 10 or 100 to quickly test your query, as doing so consumes less resources while you're still working on improving the query.
95
95
@@ -98,15 +98,15 @@ Then, once you finalize your query and are ready to use it to get all the releva
98
98
## Switch to advanced mode after building a query
99
99
You can click on **Edit in KQL** to view the KQL query generated by your selected conditions. Editing in KQL opens a new tab in advanced mode, with the corresponding KQL query:
100
100
101
-
101
+
102
102
103
-
103
+
104
104
105
105
In the above example, the selected view is All, therefore you can see that the KQL query searches all tables that have file properties of name and SHA256, and in all the relevant columns covering these properties.
106
106
107
107
If you change the view to **Emails & collaboration**, the query is narrowed down to:
108
108
109
-
109
+
110
110
111
111
## See also
112
112
-[Advanced hunting quotas and usage parameters](advanced-hunting-limits.md)
0 commit comments