Skip to content

Sentinel Hunting Ideas

Start with a broad behavior, inspect the named fields, then run the second query to expand the same account, application, resource, message, device, process, IP, or hash.

Area Use
Identity and Workload Access Password and MFA pressure, authentication takeover, OAuth persistence, privilege, and trust changes
Azure Control Plane and Storage Remote execution, storage reconnaissance, staged objects, and destructive administration
Email and Collaboration Mailbox persistence, message-to-execution chains, and external Teams activity
Endpoint and Cross-Domain First-seen tools, task/service persistence, remote execution, credential access, ransomware precursors, and LOLBins

Before running a hunt

  • Set the time picker deliberately. Each query also carries its own bounded lookback.
  • Confirm the required table is receiving current events.
  • Treat the first result as a lead, not a verdict.
  • Add approved administrator, application, partner, remote-support, scanner, and deployment-system allowlists locally.
  • Preserve immutable IDs, correlation IDs, process IDs plus creation times, hashes, and message IDs during pivots.
Check required table freshness
union isfuzzy=true withsource=TableName
    AuditLogs,
    SigninLogs,
    AzureActivity,
    StorageBlobLogs,
    StorageFileLogs,
    OfficeActivity,
    CloudAppEvents,
    EmailEvents,
    UrlClickEvents,
    DeviceProcessEvents,
    DeviceNetworkEvents
| summarize LastEvent=max(TimeGenerated), Events24h=countif(TimeGenerated > ago(24h)) by TableName
| extend Age=now() - LastEvent
| sort by LastEvent asc
Check Defender XDR event volume by table
union isfuzzy=true withsource=TableName
    DeviceEvents,
    DeviceProcessEvents,
    DeviceNetworkEvents,
    DeviceFileEvents,
    DeviceRegistryEvents,
    DeviceLogonEvents,
    EmailEvents,
    EmailUrlInfo,
    UrlClickEvents,
    CloudAppEvents
| where TimeGenerated > ago(7d)
| summarize Events=count() by TableName, bin(TimeGenerated, 1d)
| render timechart

Query surface

These pages are written for Microsoft Sentinel Log Analytics and use TimeGenerated. Defender XDR event-table hunts require the corresponding raw advanced-hunting tables to be selected in the Microsoft Defender XDR connector. A table shown by autocomplete is not proof that Sentinel is ingesting it.

Defender Vulnerability Management tables are not ingested through this connector. Run TVM queries in Defender XDR Advanced Hunting or provide a separate supported ingestion path.

Connector caution

Enabling the unified Microsoft Defender XDR connector can replace data flow from standalone Defender component connectors and can change alert schemas. Verify existing queries and incident behavior after the change.

Microsoft guidance: Microsoft Sentinel data connectors · Stream Defender XDR data to Sentinel