You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Work with results containing Microsoft Sentinel data
3
+
description: Work with advanced hunting in the portal unifying Defender XDR and Sentinel data
4
+
search.appverid: met150
5
+
ms.service: defender-xdr
6
+
ms.subservice: adv-hunting
7
+
f1.keywords:
8
+
- NOCSH
9
+
ms.author: maccruz
10
+
author: schmurky
11
+
ms.localizationpriority: medium
12
+
manager: dansimp
13
+
audience: ITPro
14
+
ms.collection:
15
+
- m365-security
16
+
- m365initiative-m365-defender
17
+
- tier1
18
+
- usx-security
19
+
ms.topic: conceptual
20
+
appliesto:
21
+
- Microsoft Defender XDR
22
+
- Microsoft Sentinel in the Microsoft Defender portal
23
+
ms.date: 08/07/2024
24
+
---
25
+
26
+
# Work with advanced hunting results containing Microsoft Sentinel data
27
+
28
+
## Explore results
29
+
30
+
Results of queries that were run appear in the **Results** tab. You can export the results to a CSV file by selecting **Export**.
31
+
32
+
:::image type="content" source="/defender/media/advanced-hunting-unified-results.png" alt-text="Screenshot of advanced hunting results with options to expand result rows in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-unified-results.png":::
33
+
34
+
You can also explore the results in-line with the following features:
35
+
36
+
- Expand a result by selecting the dropdown arrow at the left of each result
37
+
- Where applicable, expand details for results that are in JSON or array format by selecting the dropdown arrow at the left of applicable result row for added readability
38
+
- Open the side pane to see a record's details (concurrent with expanded rows)
39
+
40
+
You can also right-click on any result value in a row so that you can use it to:
41
+
- Add more filters to the existing query
42
+
- Copy the value for use in further investigation
43
+
- Update the query to extend a JSON field to a new column
44
+
45
+
For Microsoft Defender XDR data, you can take further action by selecting the checkboxes to the left of each result row. Select **Link to incident** to link the selected results to an incident (read [Link query results to an incident](advanced-hunting-link-to-incident.md)) or **Take actions** to open the Take actions wizard (read [Take action on advanced hunting query results](advanced-hunting-take-action.md)).
title: Use Microsoft Sentinel custom functions in advanced hunting in Microsoft Defender
3
+
description: Using functions, saved queries, and custom rules in advanced hunting in the portal unifying Defender XDR and Sentinel data
4
+
search.appverid: met150
5
+
ms.service: defender-xdr
6
+
ms.subservice: adv-hunting
7
+
f1.keywords:
8
+
- NOCSH
9
+
ms.author: maccruz
10
+
author: schmurky
11
+
ms.localizationpriority: medium
12
+
manager: dansimp
13
+
audience: ITPro
14
+
ms.collection:
15
+
- m365-security
16
+
- m365initiative-m365-defender
17
+
- tier1
18
+
- usx-security
19
+
ms.topic: conceptual
20
+
appliesto:
21
+
- Microsoft Defender XDR
22
+
- Microsoft Sentinel in the Microsoft Defender portal
23
+
ms.date: 08/07/2024
24
+
---
25
+
26
+
# Use Microsoft Sentinel functions, saved queries, and custom rules
27
+
28
+
29
+
## Use functions
30
+
31
+
To use a function from Microsoft Sentinel, go to the **Functions** tab and scroll until you find the function that you want. Double-click the function name to insert the function in the query editor.
32
+
33
+
You can also select the vertical ellipses (  ) to the right of the function and select **Insert to query** to insert the function into a query in the query editor.
34
+
35
+
Other options include:
36
+
-**View details** – opens the function side pane containing its details
37
+
-**Load function code** – opens a new tab containing the function code
38
+
39
+
For editable functions, more options are available when you select the vertical ellipses:
40
+
-**Edit details** – opens the function side pane to allow you to edit details about the function (except folder names for Sentinel functions)
41
+
-**Delete** – deletes the function
42
+
43
+
### Use arg() operator for Azure Resource Graph queries (Preview)
44
+
Preview customers can use the *arg()* operator to query across deployed Azure resources like subscriptions, virtual machines, CPU, storage, and the like. Read [Create alerts with Azure Resource Graph and Log Analytics](/azure/governance/resource-graph/alerts-query-quickstart?tabs=azure-resource-graph) for more details.
45
+
46
+
In the query editor, enter *arg("").* followed by the Azure Resource Graph table name.
47
+
48
+
```Kusto
49
+
arg("").<Azure-Resource-Graph-table-name>
50
+
```
51
+
52
+
You can then, for instance, filter a query that searches over Microsoft Sentinel data based on the results of an Azure Resource Graph query:
53
+
54
+
```Kusto
55
+
arg("").Resources
56
+
| where type == "microsoft.compute/virtualmachines" and properties.hardwareProfile.vmSize startswith "Standard_D"
57
+
| join (
58
+
Heartbeat
59
+
| where TimeGenerated > ago(1d)
60
+
| distinct Computer
61
+
)
62
+
on $left.name == $right.Computer
63
+
```
64
+
65
+
66
+
## Use saved queries
67
+
68
+
To use a saved query from Microsoft Sentinel, go to the **Queries** tab and scroll until you find the query that you want. Double-click the query name to load the query in the query editor. For more options, select the vertical ellipses (  ) to the right of the query. From here, you can perform the following actions:
69
+
70
+
-**Run query** – loads the query in the query editor and runs it automatically
71
+
-**Open in query editor** – loads the query in the query editor
72
+
-**View details** – opens the query details side pane where you can inspect the query, run the query, or open the query in the editor
73
+
74
+
:::image type="content" source="/defender/media/advanced-hunting-unified-view-details.png" alt-text="Screenshot of the options available in saved queries in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-unified-view-details.png":::
75
+
76
+
77
+
For editable queries, more options are available:
78
+
79
+
-**Edit details** – opens the query details side pane with the option to edit the details like description (if applicable) and the query itself; only the folder names (location) of Microsoft Sentinel queries can't be edited
80
+
-**Delete** – deletes the query
81
+
-**Rename** – allows you to modify the query name
82
+
83
+
## Create custom analytics and detection rules
84
+
85
+
To help discover threats and anomalous behaviors in your environment, you can create custom detection policies.
86
+
87
+
For analytics rules that apply to data ingested through the connected Microsoft Sentinel workspace, select **Manage rules > Create analytics rule**.
88
+
89
+
:::image type="content" source="/defender/media/advanced-hunting-unified-rules.png" alt-text="Screenshot of the options to create custom analytics or detections in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-unified-rules.png":::
90
+
91
+
The **Analytics rule wizard** appears. Fill up the required details as described in [Analytics rule wizard—General tab](/azure/sentinel/detect-threats-custom#analytics-rule-wizardgeneral-tab).
92
+
93
+
You can also create custom detection rules that query data from both Microsoft Sentinel and Defender XDR tables. Select **Manage rules > Create custom detection**. Read [Create and manage custom detection rules](custom-detection-rules.md) for more information.
94
+
95
+
If your Defender XDR data is ingested into Microsoft Sentinel, you have the option to choose between **Create custom detection** and **Create analytics rule**.
description: Advanced hunting in the portal unifying Defender XDR and Sentinel data
2
+
title: Advanced hunting with Microsoft Sentinel data in Microsoft Defender
3
+
description: Learn how to use advanced hunting in the portal unifying Defender XDR and Sentinel data
4
4
search.appverid: met150
5
5
ms.service: defender-xdr
6
6
ms.subservice: adv-hunting
@@ -25,9 +25,9 @@ appliesto:
25
25
ms.date: 10/18/2024
26
26
---
27
27
28
-
# Advanced hunting in the Microsoft Defender portal
28
+
# Advanced hunting with Microsoft Sentinel data in Microsoft Defender portal
29
29
30
-
Advanced hunting allows you to view and query all the data sources available within the Micrsoft Defender portal. The data sources might include Microsoft Defender XDR and various Microsoft security services. If you onboard Microsoft Sentinel to the Defender portal, access and use all your existing Microsoft Sentinel workspace content, including queries and functions.
30
+
Advanced hunting allows you to view and query all the data sources available within the [unified Microsoft Defender portal](/defender-xdr/microsoft-365-defender-portal). The data sources might include Microsoft Defender XDR and various Microsoft security services. If you onboard Microsoft Sentinel to the Defender portal, access and use all your existing Microsoft Sentinel workspace content, including queries and functions.
31
31
32
32
Querying from a single portal across different data sets makes hunting more efficient and removes the need for context-switching.
33
33
@@ -79,86 +79,22 @@ In the unified portal, in addition to viewing the schema column names and descri
79
79
80
80
:::image type="content" source="/defender/media/advanced-hunting-unified-view-schema.png" alt-text="Screenshot of the schema information pane in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-unified-view-schema.png":::
81
81
82
-
## Use functions
83
-
84
-
To use a function from Microsoft Sentinel, go to the **Functions** tab and scroll until you find the function that you want. Double-click the function name to insert the function in the query editor.
85
-
86
-
You can also select the vertical ellipses (  ) to the right of the function and select **Insert to query** to insert the function into a query in the query editor.
87
-
88
-
Other options include:
89
-
-**View details** – opens the function side pane containing its details
90
-
-**Load function code** – opens a new tab containing the function code
91
-
92
-
For editable functions, more options are available when you select the vertical ellipses:
93
-
-**Edit details** – opens the function side pane to allow you to edit details about the function (except folder names for Sentinel functions)
94
-
-**Delete** – deletes the function
95
-
96
-
97
-
## Use saved queries
98
-
99
-
To use a saved query from Microsoft Sentinel, go to the **Queries** tab and scroll until you find the query that you want. Double-click the query name to load the query in the query editor. For more options, select the vertical ellipses (  ) to the right of the query. From here, you can perform the following actions:
100
-
101
-
-**Run query** – loads the query in the query editor and runs it automatically
102
-
-**Open in query editor** – loads the query in the query editor
103
-
-**View details** – opens the query details side pane where you can inspect the query, run the query, or open the query in the editor
104
-
105
-
:::image type="content" source="/defender/media/advanced-hunting-unified-view-details.png" alt-text="Screenshot of the options available in saved queries in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-unified-view-details.png":::
106
-
107
-
108
-
For editable queries, more options are available:
109
-
110
-
-**Edit details** – opens the query details side pane with the option to edit the details like description (if applicable) and the query itself; only the folder names (location) of Microsoft Sentinel queries can't be edited
111
-
-**Delete** – deletes the query
112
-
-**Rename** – allows you to modify the query name
113
-
114
-
## Create custom analytics and detection rules
115
-
116
-
To help discover threats and anomalous behaviors in your environment, you can create custom detection policies.
117
-
118
-
For analytics rules that apply to data ingested through the connected Microsoft Sentinel workspace, select **Manage rules > Create analytics rule**.
119
-
120
-
:::image type="content" source="/defender/media/advanced-hunting-unified-rules.png" alt-text="Screenshot of the options to create custom analytics or detections in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-unified-rules.png":::
121
-
122
-
The **Analytics rule wizard** appears. Fill up the required details as described in [Analytics rule wizard—General tab](/azure/sentinel/detect-threats-custom#analytics-rule-wizardgeneral-tab).
123
-
124
-
You can also create custom detection rules that query data from both Microsoft Sentinel and Defender XDR tables. Select **Manage rules > Create custom detection**. Read [Create and manage custom detection rules](custom-detection-rules.md) for more information.
125
-
126
-
If your Defender XDR data is ingested into Microsoft Sentinel, you have the option to choose between **Create custom detection** and **Create analytics rule**.
127
-
128
-
129
-
## Explore results
130
-
131
-
Results of queries that were run appear in the **Results** tab. You can export the results to a CSV file by selecting **Export**.
132
-
133
-
:::image type="content" source="/defender/media/advanced-hunting-unified-results.png" alt-text="Screenshot of advanced hunting results with options to expand result rows in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-unified-results.png":::
134
-
135
-
You can also explore the results in-line with the following features:
136
-
137
-
- Expand a result by selecting the dropdown arrow at the left of each result
138
-
- Where applicable, expand details for results that are in JSON or array format by selecting the dropdown arrow at the left of applicable result row for added readability
139
-
- Open the side pane to see a record's details (concurrent with expanded rows)
140
-
141
-
You can also right-click on any result value in a row so that you can use it to:
142
-
- Add more filters to the existing query
143
-
- Copy the value for use in further investigation
144
-
- Update the query to extend a JSON field to a new column
145
-
146
-
For Microsoft Defender XDR data, you can take further action by selecting the checkboxes to the left of each result row. Select **Link to incident** to link the selected results to an incident (read [Link query results to an incident](advanced-hunting-link-to-incident.md)) or **Take actions** to open the Take actions wizard (read [Take action on advanced hunting query results](advanced-hunting-take-action.md)).
147
-
148
82
## Known issues
149
83
150
84
- The `IdentityInfo table` from [Microsoft Sentinel](/azure/sentinel/ueba-reference#identityinfo-table) isn't available, as the `IdentityInfo` table remains as is in Defender XDR. Microsoft Sentinel features like analytics rules that query this table aren't impacted as they're querying the Log Analytics workspace directly.
151
85
- The Microsoft Sentinel `SecurityAlert` table is replaced by `AlertInfo` and `AlertEvidence` tables, which both contain all the data on alerts. While SecurityAlert isn't available in the schema tab, you can still use it in queries using the advanced hunting editor. This provision is made so as not to break existing queries from Microsoft Sentinel that use this table.
152
-
- Guided hunting mode, links to incidents, and take actions capabilities are supported for Defender XDR data only.
86
+
- Guided hunting mode and take actions capabilities are supported for Defender XDR data only.
153
87
- Custom detections have the following limitations:
154
88
- Custom detections are not available for KQL queries that do not include Defender XDR data.
155
89
- Near real-time detection frequency is not available for detections that include Microsoft Sentinel data.
156
90
- Custom functions that were created and saved in Microsoft Sentinel are not supported.
157
91
- Defining entities from Sentinel data is not yet supported in custom detections.
158
-
- Bookmarks aren't supported in the advanced hunting experience. They're supported in the **Microsoft Sentinel > Threat management > Hunting** feature.
92
+
- Bookmarks aren't supported in the advanced hunting experience. They're supported in the **Microsoft Sentinel > Threat management > Hunting** feature.
159
93
- If you're streaming Defender XDR tables to Log Analytics, there might be a difference between the`Timestamp` and `TimeGenerated` columns. In case the data arrives to Log Analytics after 48 hours, it's being overridden upon ingestion to `now()`. Therefore, to get the actual time the event happened, we recommend relying on the `Timestamp` column.
160
94
- When prompting [Copilot for Security](advanced-hunting-security-copilot.md) for advanced hunting queries, you might find that not all Microsoft Sentinel tables are currently supported. However, support for these tables can be expected in the future.
161
95
162
96
97
+
## See also
163
98
164
-
99
+
-[Use advanced hunting functions, saved queries, and custom rules](advanced-hunting-defender-use-custom-rules.md)
100
+
-[Explore advanced hunting results with Microsoft Sentinel data](advanced-hunting-defender-results.md)
Copy file name to clipboardExpand all lines: defender-xdr/whats-new.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,9 +29,11 @@ For more information on what's new with other Microsoft Defender security produc
29
29
30
30
You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter).
31
31
32
+
32
33
## October 2024
33
34
34
35
-[Microsoft Unified RBAC roles](experts-on-demand.md#required-permissions-for-using-ask-defender-experts) are added with new permission levels for Microsoft Threat Experts customers to use Ask Defender experts capability.
36
+
- (Preview) In [advanced hunting](advanced-hunting-defender-use-custom-rules.md#use-arg-operator-for-azure-resource-graph-queries-preview), Microsoft Defender portal users can now use the *arg()* operator for Azure Resource Graph queries to search over Azure resources. You no longer need to go to Log Analytics in Microsoft Sentinel to use this operator if you are already in Microsoft Defender.
35
37
36
38
## September 2024
37
39
@@ -105,7 +107,7 @@ You can also get product updates and important notifications through the [messag
105
107
106
108
- (Preview) You can now query Microsoft Sentinel data using the [advanced hunting query API](/graph/api/security-security-runhuntingquery?view=graph-rest-1.0&tabs=http&preserve-view=true). You can use the `timespan` parameter to query Defender XDR and Microsoft Sentinel data that have longer data retention than the Defender XDR default of 30 days.
107
109
108
-
- (Preview) In the unified Microsoft Defender portal, you can now create custom detections in querying data that spans Microsoft Sentinel and Defender XDR tables. Read [Create custom analytics and detection rules](advanced-hunting-microsoft-defender.md#create-custom-analytics-and-detection-rules) for more information.
110
+
- (Preview) In the unified Microsoft Defender portal, you can now create custom detections in querying data that spans Microsoft Sentinel and Defender XDR tables. Read [Create custom analytics and detection rules](advanced-hunting-defender-use-custom-rules.md) for more information.
109
111
110
112
- Updated [troubleshooting steps for Microsoft Defender Experts app permissions in Microsoft Teams](teams-restrictions-dexapp.md).
0 commit comments