Microsoft Defender XDR Advanced Hunting Starter Guide

Filter and project the evidence

Use indexed/specific operators where possible: exact equality and case-sensitive operators can be faster; has is usually more efficient than substring contains. Filter before parsing and project only the evidence fields.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (
  "powershell.exe",
  "pwsh.exe")
| where ProcessCommandLine
  has_any ("DownloadString",
           "WebRequest")
| project Timestamp, DeviceId,
  DeviceName, AccountUpn,
  FileName, ProcessCommandLine,
  InitiatingProcessFileName
| top 200 by Timestamp desc

Use let for clear stages

Define parameters and narrowed intermediate results so peer reviewers can understand and test each stage. Keep entity/time normalization explicit.

let StartTime = ago(48h);
let TargetAccounts =
  dynamic(["user1@contoso.com"]);
IdentityLogonEvents
| where Timestamp > StartTime
| where AccountUpn
  in~ (TargetAccounts)
| summarize Attempts=count(),
            IPs=dcount(IPAddress)
  by AccountUpn, Application
| order by Attempts desc

Use stable identifiers

Prefer DeviceId over display name, AccountObjectId/SID over mutable UPN where supported, SHA256 over file name, NetworkMessageId/InternetMessageId with documented semantics, application/object IDs over display names, and normalized URL/domain/IP fields. Preserve original values alongside normalized keys.

Time-bound relationships

A matching account or URL across 30 days does not prove one attack. Require a plausible sequence/window and annotate ingestion delay. Apply UTC filters to every joined table, compare event time rather than only alert time, and calculate deltas between related activity.

One-to-many and duplicates

One message can have many recipients/URLs/attachments; one identity many devices/sessions; one hash many file paths; one IP many users behind NAT/proxy; one alert many evidence rows. Summarize or deduplicate only after preserving the question each row represents.

Dynamic fields and parsing

Filter first, then parse AdditionalFields or other dynamic content with parse_json/parse when needed. Validate keys/types/nulls and schema versions. Avoid expensive regex unless simpler parsing and indexed predicates cannot answer the question. Project parsed fields with clear names and source columns.

Entity enrichment

Join criticality, device groups/tags, exposure, identity role, sensitivity, site/mailbox/business ownership, and incident context only from approved sources and effective dates. Enrichment should explain risk; stale or broad enrichment can bias severity and scope.

Entity mapping

Custom detections need supported entity identifiers for useful alert context and actions. Validate DeviceId, AccountObjectId/SID/UPN, IP, URL, file hash, mailbox/message, app/resource, and other required columns. Wrong or unstable mapping creates misleading incidents or unsafe actions.

Time and schedule logic

Align the query Timestamp window with rule frequency and ingestion delay. Prevent duplicate detection of the same event across overlapping runs or missed late events. Test daylight-saving presentation separately while keeping KQL UTC. Document lookback, deduplication key, and late-arrival behavior.

Positive/negative testing

Use known attack simulations or approved synthetic events, benign business samples, high-volume periods, missing fields, service accounts, shared devices, NAT/proxy, common tools, and historical incidents. Measure precision, recall where possible, alert latency, duplicates, and analyst effort.

Response-action gate

Start alert-only for high-impact detections. Add automated containment only after target accuracy, business safety, rollback, Action Center workflow, owner availability, and emergency disablement are proven. Monitor every triggered action and reconcile it with the incident.

Operational lifecycle

Track enabled/disabled/failed state, execution and resource use, triggered alerts/actions, classifications, false positives, missed incidents, schema/product changes, owner, review date, expiry, query version, tuning, and rollback. Retire obsolete rules and preserve history.