Merge pull request #5692 from MicrosoftDocs/poliveria-custom-functions-11202025

Update custom functions doc and add new images

Author: poliveria

defender-xdr/advanced-hunting-custom-functions.md

@@ -36,39 +36,63 @@ ms.date: 03/28/2025
 > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
 
 ## Types of functions
-A function is a type of query in advanced hunting that can be used in other queries as if it's a command. You can create your own custom functions so you can reuse any query logic when you hunt in your environment.
+A function is a type of query in advanced hunting that you can use in other queries as if it's a command. You can create your own custom functions so you can reuse any query logic when you hunt in your environment.
 
 There are three different types of functions in advanced hunting:
 
 ![Function types](/defender/media/advanced-hunting-custom-fxns/function-types.png)
 
-- **Built-in functions** – Prebuilt functions included with Microsoft Defender XDR advanced hunting. These are available in all advanced hunting instances and can't be modified.
-- **Shared functions** – Custom functions created by users, which are available for all users in a specific tenant and can be modified and controlled by users.
-- **My functions** – Custom functions created by a user, which can be viewed and modified only by the user who created it.
+- **Built-in functions** – Prebuilt functions included with Microsoft Defender XDR advanced hunting. These functions are available in all advanced hunting instances and can't be modified.
+- **Shared functions** – Custom functions that users create. All users in a specific tenant can access these functions. Users can modify and control these functions.
+- **My functions** – Custom functions that a user creates. Only the user who created these functions can view and modify them.
 
 ## Write your own custom function
 
-To create a function from the current query in the editor, select **Save** and then **Save as function**.
+To create a function from the current query in the editor:
 
-![Save as function](/defender/media/advanced-hunting-custom-fxns/save-as-function.png)
+1. Select **Save** and then **Save as function**.
+  ![Save as function](/defender/media/advanced-hunting-custom-fxns/save-as-function.png)
 
-Next, provide the following information:
+1. In the **Save as function** flyout panel, provide the following information:
 
-- **Name** - Name of the function. Can contain only numbers, English letters, and underscores. To avoid accidentally using Kusto keywords, begin or end function names with an underscore or begin with a capital letter.
-- **Location** - The folder in which you would like to save the function, either shared or private.
-- **Description** - A description that can help other users understand the purpose of the function and how it works.
-- **Parameters** - Add a parameter for each variable in the function that requires a value when it's used. 
-Add parameters to a function so that you can provide the arguments or values for certain variables when calling the function. This allows the same function to be used in different queries, each allowing for different values for the parameters. Parameters are defined by the following properties:
+    - **Name** - Name of the function. Can contain only numbers, English letters, and underscores. To avoid accidentally using Kusto keywords, begin or end function names with an underscore or begin with a capital letter.
+    - **Location** - The folder in which you want to save the function, either shared or private.
+    - **Description** - A description that helps other users understand the purpose of the function and how it works.
+    - **Parameters** - Add a parameter for each variable in the function that requires a value when it's used. For more information, see [Add parameters to your custom function](#add-parameters-to-your-custom-function).
+
+    ![Save as function dialog box](/defender/media/advanced-hunting-custom-fxns/save-as-function-dialog-box.png)
+
+1. Select **Save**.
+
+### Add parameters to your custom function
+
+You can add parameters to a function so that you can provide the arguments or values for certain variables when calling the function. This feature allows the same function to be used in different queries, each with different values for the parameters. 
+
+To add parameters when saving your custom function, select **Add parameter**, then enter the following properties:
   - **Type** - Data type for the value
   - **Name** - The name that must be used in the query to replace the parameter value
-  - **Default value** - Value to be used for the parameter if a value isn't provided
+  - **Default value** - Value to use for the parameter if you don't provide a value
 
-  Parameters are listed in the order they were created, with parameters that have no default value listed above those that have a default value.
+Parameters are listed in the order you create them, with parameters that have no default value listed before those that have a default value.
 
-![Save as function dialog box](/defender/media/advanced-hunting-custom-fxns/save-as-function-dialog-box.png)
+### Create custom functions with tabular parameters
 
+Create custom functions that use tabular parameters. With tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries. This capability is especially useful for complex hunting scenarios that require structured data inputs.
+
+To create tabular parameters for your custom function:
+1. Select **Add parameter** and then choose **table** as its **Type**.
+1. Enter a **Name** and **Default value** for the table.
+1. Map each column that your query references to the table. Select **Add column**, then enter the column's properties.
+
+![Table parameter in custom functions](/defender/media/advanced-hunting-custom-fxns/save-as-function-table.png)
+
+> [!NOTE]
+>- You can save a function with more than one table. 
+>- If your query doesn't reference any columns in the table parameter, you can still save and run the function without mapping any columns. 
+>- You can set tabular and scalar parameters in the same function.
+  
 ## Use a custom function
-Use a function in a query by typing its name along with values for any parameter just as you would type in a command. The output of the function can either be returned as results or piped to another command.
+Use a function in a query by typing its name along with values for any parameter, just as you would type in a command. The output of the function can either be returned as results or piped to another command.
 
 Add a function to the current query by double-clicking on its name or selecting the three dots to the right of the function and selecting **Open in query editor**. 
 
@@ -77,27 +101,27 @@ If a query requires arguments, provide them using the following syntax: *functio
 ![Open in query editor](/defender/media/advanced-hunting-custom-fxns/open-in-query-editor.png)
 
 > [!NOTE]
-> Functions can't be used inside another function.
+> You can't use functions inside another function.
 
 ## Work with function codes
-You can view the code of a function either to gain insight into how it works or to modify its code. Select the three dots to the right of the function and select **Load function code** to open a new tab with the function code. 
+You can view the code of a function to understand how it works or to modify its code. Select the three dots to the right of the function and select **Load function code** to open a new tab with the function code. 
 
 ![Load function code](/defender/media/advanced-hunting-custom-fxns/load-function-code.png)
 
 ## Edit a custom function
 
-Edit the properties of a function by selecting the three dots to the right of the function and selecting **Edit details**. Make any modifications that you want to the properties and parameters of the function then select **Save**.
+Edit the properties of a function by selecting the three dots to the right of the function and selecting **Edit details**. Make any modifications that you want to the properties and parameters of the function, then select **Save**.
 
 ![Edit function code](/defender/media/advanced-hunting-custom-fxns/edit-function.png)
 
-If the function code is already loaded to the editor, you can also select **Save** to apply any changes to the code or properties of the function.
+If the function code is already loaded in the editor, you can also select **Save** to apply any changes to the code or properties of the function.
 
 > [!NOTE]
 > Once a function is in use in a saved query or a detection rule, you can't edit the function to expand its scope. For example, if you saved a function that queries identity tables, and this function is used in a detection rule, you can't edit the function to include a device table after the fact. To do that, you can save a new function. Product scoping can be narrowed for the same function but not extended.
 
 ## Delete a custom function
 
-You can delete functions from **My functions** and functions you created in **Shared functions**. You cannot delete functions that you have not created, unless you have security data manage permissions.
+You can delete functions from **My functions** and functions you created in **Shared functions**. You can't delete functions that you didn't create, unless you have security data manage permissions.
 
 To delete a function, select the three dots to the right of the function and select **Delete**.
 

defender-xdr/whats-new.md

@@ -34,6 +34,7 @@ You can also get product updates and important notifications through the [messag
 
 ## December 2025
 - (GA) The [hunting graph](advanced-hunting-graph.md) in advanced hunting is now generally available. It also now has two new predefined threat scenarios that you can use to render your hunts as interactive graphs.
+- Advanced hunting now supports custom functions that use tabular parameters. With tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries. [Learn more](advanced-hunting-custom-functions.md#create-custom-functions-with-tabular-parameters)
 
 ## November 2025
 - Microsoft Sentinel customers using the Defender portal, or the Azure portal with the Microsoft Sentinel Defender XDR data connector, now also benefit from Microsoft Threat Intelligence alerts that highlight activity from nation-state actors, major ransomware campaigns, and fraudulent operations. To view these alert types, you must have the **Security Administrator** or **Global Administrator** role. The **Service Source**, **Detection Source**, and **Product Name** values for these alerts are listed as *Microsoft Threat Intelligence*.   For more information, see [Incidents and alerts in the Microsoft Defender portal](incidents-overview.md).