Click it in the Defender portal on an event or entity and it runs a prepared advanced hunting query about that item.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Go hunt in context, with comparison tables and the common traps.
Terms in this definition
- Event
Table in Log Analytics where entries from Windows event logs are kept.
- Entity
Something like a product or customer that an organisation stores data about. Its characteristics are its attributes, and every individual record is one instance.
- Agents (classic) API
First-generation Foundry Agent Service API, based on threads, messages and runs. It is deprecated, replaced by conversations and responses, and retires on 31 March 2027.
- Advanced hunting
Threat-hunting feature of the Microsoft Defender portal that runs KQL over 30 days of raw Defender XDR data, plus onboarded Sentinel data, and supports custom detections. It finds activity after it happens rather than blocking it.