Hunting Workflows

Start with a broad behavior, inspect the named evidence, and use the focused pivot to expand the same account, application, resource, message, device, process, IP address, or hash. Choose the workflow by query surface and available telemetry.

Microsoft Sentinel
Two-step identity, Azure, collaboration, endpoint, and cross-domain KQL hunts.

AWS Serverless and Microservices
Lambda, IAM, secrets, S3, VPC Flow Log, and input-manipulation hunts.

Choose a workflow

Evidence or surface	Start here
Sentinel Log Analytics or Defender XDR tables	Microsoft Sentinel
Identity, workload credentials, OAuth, or privilege changes	Identity and Workload Access
Azure control plane, storage, remote execution, or destructive administration	Azure Control Plane and Storage
Email, mailbox, Teams, or collaboration activity	Email and Collaboration
Device, process, credential access, lateral movement, ransomware, or LOLBins	Endpoint and Cross-Domain
AWS Lambda, IAM, STS, Secrets Manager, S3, or VPC evidence	AWS Serverless and Microservices

Before running a workflow

Confirm the execution surface, required tables, connector state, time range, retention, and expected administrative activity. A content package or connector configuration does not guarantee that the required telemetry is flowing.