Fixes BUG 151694

Author: Ken Lawson

learn-pr/wwl-sci/use-search-jobs-microsoft-sentinel/2-hunt-search-job.yml

@@ -4,8 +4,8 @@ title: Hunt with a Search Job
 metadata:
   title: Hunt with a Search Job
   description: "Hunt with a Search Job"
-  ms.date: 03/05/2025
-  author: wwlpublish
+  ms.date: 07/03/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: unit
 azureSandbox: false

learn-pr/wwl-sci/use-search-jobs-microsoft-sentinel/includes/2-hunt-search-job.md

@@ -3,32 +3,35 @@ One of the primary activities of a security team is to search logs for specific
 In Microsoft Sentinel, you can search across long time periods in large datasets by using a search job. While you can run a search job on any type of log, search jobs are ideally suited to search archived logs. If you need to do a full investigation on archived data, you can restore that data into the hot cache to run high performing queries and analytics.
 
 ## Search large datasets
+
 Use a search job when you start an investigation to find specific events in logs within a given time frame. You can search all your logs to find events that match your criteria and filter through the results.
 
 Search in Microsoft Sentinel is built on top of search jobs. Search jobs are asynchronous queries that fetch records. The results are returned to a search table that's created in your Log Analytics workspace after you start the search job. The search job uses parallel processing to run the search across long time spans, in large datasets. So search jobs don't impact the workspace's performance or availability.
 
 Search results remain in a search results table that has a ***_SRCH** suffix.
 
 ## Supported log types
+
 Use search to find events in any of the following log types:
 
 - Analytics logs
-- Basic logs 
+- Basic logs
+- Auxiliary logs
 
 ## Limitations of a search job
+
 Before you start a search job, be aware of the following limitations:
 
 - Optimized to query one table at a time.
 - Search date range is up to one year.
-- Supports long running searches up to a 24-hour time-out.
+- Supports long running searches up to a 24-hour timeout.
 - Results are limited to one million records in the record set.
 - Concurrent execution is limited to five search jobs per workspace.
 - Limited to 100 search results tables per workspace.
 - Limited to 100 search job executions per day per workspace.
 
-
-
 ## Start a search job
+
 Go to Search in Microsoft Sentinel to enter your search criteria.
 
 1. In the Azure portal, go to Microsoft Sentinel and select the appropriate workspace.
@@ -60,6 +63,3 @@ View the status and results of your search job by going to the Saved Searches ta
 1. To refine the list of results returned from the search table, edit the KQL query.
 
 1. As you're reviewing your search job results, bookmark rows that contain information you find interesting so you can attach them to an incident or refer to them later.
-
-
-

learn-pr/wwl-sci/use-search-jobs-microsoft-sentinel/index.yml

@@ -3,8 +3,8 @@ uid: learn.wwl.use-search-jobs-microsoft-sentinel
 metadata:
   title: Use Search jobs in Microsoft Sentinel
   description: "Use Search jobs in Microsoft Sentinel"
-  ms.date: 03/05/2025
-  author: wwlpublish
+  ms.date: 07/03/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: module
   ms.service: microsoft-sentinel