Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
Hunting and detection

Hunts in Microsoft Defender Experts Hunting overview - Microsoft Defender XDR | Microsoft Learn

5 October 2026Generally availableAction required+103 / −0 lines

In brief

The Hunts overview documents an experience for viewing in-progress and completed expert-led hunts, including hunt types, statuses, outcomes, and supporting details in the Defender portal.

What Defender admins need to know

To use Hunts, the organization must be enrolled in Defender Experts Hunting, Plan 1, or Plan 2, and the accessing account must have at least the Security Reader role in Microsoft Defender RBAC.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

new file mode 100644

layout: Conceptual title: Hunts in Microsoft Defender Experts Hunting overview - Microsoft Defender XDR | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/defender-xdr/defender-experts/defender-experts-hunting-hunts breadcrumb_path: /defender-xdr/breadcrumb/toc.json permissioned-type: public feedback_system: Standard feedback_product_url: https://techcommunity.microsoft.com/t5/microsoft-365-defender/bd-p/MicrosoftThreatProtection uhfHeaderId: MSDocsHeader-MicrosoftDefender manager: orspodek description: Learn how Hunts in Microsoft Defender Experts Hunting gives security teams visibility into in-progress and completed expert-led threat investigations. ms.service: defender-experts-for-hunting ms.author: dpersaud author: dpersaud-microsoft ms.localizationpriority: medium ms.collection:

Hunts in Microsoft Defender Experts Hunting overview - Microsoft Defender XDR | Microsoft Learn

Hunts is an experience in Microsoft Defender Experts Hunting that gives security teams a centralized view of threat hunts Microsoft experts conduct in their environment. Use Hunts to see expert threat hunting activities while they're both in progress to see what threats we're currently tracking, and after completion to review the outcome and supporting details.

Hunts provides a record of proactive hunting activity, including investigations that don't result in uncovering an undetected threat. This visibility helps you understand what Defender Experts hunted, what they found, and whether your team needs to take follow-up action.

Hunts is generally available to Defender Experts customers. Before you use Hunts, your organization must be enrolled in Defender Experts Hunting, Plan 1, or Plan 2, and your account must have at least the Security Reader role in Microsoft Defender role-based access control (RBAC).

Applies to:

Prerequisites

View hunt activity in one place

In the Microsoft Defender portal, select Defender Experts > Hunts to view hunts conducted in your environment.

The Hunts experience distinguishes investigations that are still in progress from completed investigations. You can monitor an active investigation and return after it concludes to review the final outcome.

Screenshot of the Hunts page showing in-progress and completed Defender Experts investigations.

Understand hunt types

Defender Experts conducts the following types of hunts:

  • Intelligence-based hunts: Proactive investigations of emerging threats, attacker techniques, campaigns, and other intelligence-driven hypotheses.
  • Suspicious activity hunts: Investigations that begin when Defender Experts identifies behavior in your environment that warrants deeper analysis.

Follow a hunt from investigation to outcome

The hunt status helps you distinguish ongoing work from final conclusions.

StatusWhat it means
In progressDefender Experts is still investigating. The available information isn't a final conclusion.
CompletedThe investigation has concluded. You can review the outcome and supporting details, including when the hunt didn't result in an incident.

When a noteworthy threat is circulating, Hunts lets you see that Defender Experts is investigating it on your behalf. After the hunt is complete, review the findings to determine whether your organization needs to take action.

Screenshot of a completed Defender Experts hunt showing the investigation status, summary, and outcome.

How Hunts works

Defender Experts investigates intelligence-based hypotheses and suspicious activity in your environment. Hunts shows the investigation as it progresses:

  1. Defender Experts starts a hunt based on threat intelligence or suspicious behavior.
  2. The hunt appears as In progress while the investigation continues.
  3. Defender Experts completes the investigation and records the outcome.
  4. You review the completed hunt and its supporting details to determine whether follow-up action is needed. \ No newline at end of file