Daily Defender News
Aboutmerill.net
Cross-product topic

Hunting and detection

A cross-product view of Microsoft Defender changes related to Hunting and detection.

Latest Hunting and detection changes

Advanced Hunting Schema Changes

Hunting and detection

The `AadDeviceId` column is being replaced by `EntraIdDeviceId`. `AadDeviceId` will remain available for 30 days to support query updates.

Api Advanced Hunting

Hunting and detection

The page’s author metadata changed from EdB-MSFT (edbaynash) to Karinschwabacher13 (kschwabacher).

Advanced Hunting Clouddnsevents Table

Hunting and detection

The table reference replaces DnsEventType and DnsEventSubType with EventType and EventSubType, and updates the request-filter example accordingly.

Advanced Hunting Agentsinfo Table

Hunting and detection

The page no longer includes the notice that some information concerns prereleased products subject to substantial change before commercial release.

Advanced Hunting Aiagentsinfo Table

Hunting and detection

The AIAgentsInfo advanced hunting table is transitioning to AgentsInfo. AIAgentsInfo remains accessible until July 1, 2026, and its reference documentation was removed.

Advanced Hunting Schema Changes

Hunting and detection

The documentation now describes the transition from `AIAgentsInfo` to the unified `AgentsInfo` table, which expands beyond Copilot Studio-specific columns.

Advanced Hunting Schema Tables

Hunting and detection

The schema page no longer labels AgentsInfo as Preview and no longer lists AIAgentsInfo.

Custom Detection Manage

Hunting and detection

The documentation now states that custom detections are included in correlation by default and have a per-rule option to include or exclude them.

Custom Detection Manage

Hunting and detection

The Edit option description now notes flexible frequency and lookback for all supported data sources and links to further guidance.

Custom Detection Manage

Hunting and detection

The Edit description no longer mentions flexible frequency and lookback being in public preview or links to related guidance. Author and date metadata also changed.

Custom Detection Rules

Hunting and detection

The documentation now describes independently configuring detection frequency from 5 minutes to 14 days and lookback from 5 minutes to 30 days across supported data sources. Lookback must be at least as long as the frequency to avoid coverage gaps.

Custom Detection Rules

Hunting and detection

Custom frequency from 5 minutes to 14 days is available only for rules based exclusively on Microsoft Sentinel data. Rules using Defender XDR data now use fixed lookback periods based on their run frequency, ranging from 4 hours to 30 days.

Microsoft Defender for Office 365: View approver details for remediation actions in Advanced Hunting

Message CenterMC1478005 on mc.merill.net ↗Plan for change
Hunting and detection

Microsoft Defender for Office 365 added an ApproverUpn column to the EmailPostDeliveryEvents table in Advanced Hunting, showing who approved remediation actions. This enables faster investigations without using Action Center. The feature is available worldwide, enabled by default, and requires no action from administrators.

Microsoft Defender for Office 365: New MessageContents table in Advanced Hunting for Microsoft Teams messages

Message CenterMC1474106 on mc.merill.net ↗Stay informed
Hunting and detection

Microsoft Defender for Office 365 introduces a new MessageContents table in Advanced Hunting for Teams messages, enabling authorized security analysts to query message snippets and metadata for threat investigations. It rolls out worldwide from late September to mid-October 2026, requiring appropriate permissions for access.

Advanced Hunting Query Results

Hunting and detection

Advanced hunting results can be mapped to nodes and edges using a Builder or JSON, then explored with entity enrichment, relationship details, folding, and mapping edits.

Best practices for graph mapping in advanced hunting

Hunting and detection

A new page explains how to prepare query results, configure graph nodes and edges, apply relationship conditions, and use recognized entity types and identifiers for Defender enrichment.

Advanced Hunting Clouddnsevents Table

Hunting and detection

The table documentation now describes ImageDigest, Region, and HostName, including their meanings for container image, cluster region, and node hostname data.

Advanced Hunting Defender Use Custom Rules

Hunting and detection

The article now warns that deleting functions and saved queries is permanent, clarifies guidance for the `adx()`, `arg()`, and `workspace()` operators, updates menu image descriptions, and renames analytics rule section headings.

Advanced Hunting Emailevents Table

Hunting and detection

The Advanced Hunting EmailEvents page updated its ownership metadata and date, and changed the documented column reference for sender, recipient, delivery, threat, authentication, and policy fields.

Advanced Hunting Extend Data

Hunting and detection

The page wording was revised to emphasize correct settings across data sources, and section headings now clearly describe enabling Windows advanced security auditing and installing the Defender for Identity sensor. Section anchors and the page date were also updated.

Advanced Hunting Go Hunt

Hunting and detection

The documentation date changed to July 2, 2026, and the wording now specifies that the associated incident includes the entity.

Advanced Hunting Limits

Hunting and detection

The explanation now explicitly describes the difference between average daily use and top daily use; the example values remain 75% and 100%. The document date was updated to July 2, 2026.

Advanced Hunting Link To Incident

Hunting and detection

The article date and wording were updated, with shorter instructions for running queries, confirming prerequisites, troubleshooting, creating alerts, viewing linked incidents, and filtering manually detected alerts.

Advanced Hunting Microsoft Defender

Hunting and detection

The documentation now states that a newly created Microsoft Sentinel function in Log Analytics can take up to 20 minutes to appear in advanced hunting.

Advanced Hunting Migrate From Mde

Hunting and detection

The documentation now clarifies migration queries from Microsoft Defender for Endpoint, including PowerShell technique filtering, AlertInfo and AlertEvidence joins, and entity filtering. It also updates the Microsoft Defender XDR setup link and publication date.

Advanced Hunting Modes

Hunting and detection

The article now includes an updated section heading, refreshed screenshots and image descriptions, clearer guided-tour wording, and a new publication date.

Advanced Hunting Overview

Hunting and detection

The documentation now distinguishes 30-day native Defender XDR data retention from Microsoft Sentinel analytics-tier retention. It explains that onboarding a Sentinel workspace and configuring table retention can support longer retention, while streaming to external services remains another option.

Advanced Hunting Query Builder

Hunting and detection

Updated the publication date, clarified wording for the Run query and All filters controls, improved screenshot descriptions, and renamed the Related content section with an anchor.

Advanced Hunting Query Builder Details

Hunting and detection

The page updates its date, clarifies when the EventType filter is available, and improves descriptions of EventType, sample-size, Edit in KQL, and generated KQL screenshots. It also specifies the file-name and SHA256 example when describing narrowed Emails & collaboration queries.

Advanced Hunting Query Emails Devices

Hunting and detection

The article date was updated, and explanatory text was revised to clarify extracting the account name from recipient email addresses and checking logon activity on a recipient's device after ZAP processing.

Advanced Hunting Query History

Hunting and detection

The Query history section was reworded for clarity, with an updated date and new section anchor. It continues to describe rerunning past queries, retaining up to 30 queries from the last 28 days, and using or editing queries.

Advanced Hunting Query Language

Hunting and detection

The article now uses clearer terms for the advanced hunting schema and time zone settings, identifies the Get started pane on the Advanced hunting page in the Microsoft Defender portal, and fixes link wording. The article date was updated to July 2, 2026.

Advanced Hunting Query Results

Hunting and detection

The article adds stable anchors and clearer “Example chart” headings, refines query descriptions, identifies the newly added filter, and documents when the timeline appears: results must contain more than 40 events and a `Timestamp` or `timeGenerated` column.

Advanced Hunting Security Copilot

Hunting and detection

The documentation now describes Rich insights and Query only modes, with Rich insights as the default. It updates mode-switching steps, notes that modes aren't available on non-primary workspaces, and explains that switching starts a new chat and clears the current conversation. It also documents support for queries spanning multiple tables.

Advanced Hunting Shared Queries

Hunting and detection

The page date moved to July 2, 2026. Wording now describes query sections as lists or groups, simplifies rename and delete instructions, updates the GitHub contribution link, and directs readers to threat analytics reports in the Defender portal.

Attack path analysis and enhanced risk-hunting for containers

Hunting and detection

The article description, prerequisites wording, attack-path guidance link text, metadata, and publication date were updated. It now describes deploying a mock vulnerable container image to explore container risks with Cloud Security Explorer.

CallActivityEvents table in the advanced hunting schema

Hunting and detection

The new table documents Microsoft Teams call activity details, including timestamps, call and participant identifiers, activity types, scheduling information, and join links. It is populated by Microsoft Defender for Office 365.

Conduct End-to-end Threat Hunting with Hunts

Hunting and detection

Updated the Hunts article title and metadata, clarified instructions and terminology, refined section headings, and renamed “Next steps” to “Related content.”

Create custom hunting queries in Microsoft Sentinel

Hunting and detection

The article now describes writing, cloning, and editing KQL-based hunting queries, clarifies the navigation sequence, and specifies that queries from content hub solutions or repositories must be edited in their original source.

Custom Detection Rules

Hunting and detection

The documentation adds support for governance actions on supported SaaS identities returned by CloudAppEvents queries. Queries must include AccountObjectId, InstanceId, ApplicationId, AppInstanceId, and other required fields; unsupported actions or services produce no action.

Defender Experts Hunting Ask Experts

Hunting and detection

The documentation now includes screenshots showing the Ask Defender Experts option on the Defender Experts overview page and in the message center. The page metadata and authoring identifier were also updated.

Defender Experts Hunting Prerequisites

Hunting and detection

The prerequisites now document storage locations for hunting, reporting, and operational data; retention of up to 90 days after subscription expiry and deletion within 30 days after termination; and availability for eligible GCC customers through Defender Experts Hunting for Gov.

DeviceLogonEvents table in the advanced hunting schema

Hunting and detection

The page now explains that token creation events initiated by lsass.exe can include access-token privilege context in AdditionalFields. It also refines guidance for investigating authentication activity and privileged logons.

DeviceProcessEvents table in the advanced hunting schema

Hunting and detection

The page corrects the table name, clarifies that initiating-process signature fields do not describe the created process, and adds a Kusto query that joins DeviceFileCertificateInfo to retrieve signing details.

Hunting Capabilities in Microsoft Sentinel

Hunting and detection

The hunting documentation was updated with clearer wording for query examples and result-delta metrics, a revised Azure Data Explorer link title, and reorganized custom connector resources.

Hunting Overview

Hunting and detection

The overview replaces the Infrastructure chaining entry with a Threat analytics link for tracking emerging threats and reviewing Microsoft threat research and insights. The reactive hunting table formatting was also adjusted.

Manage custom detection rules in Microsoft Defender XDR

Hunting and detection

The article now explicitly covers viewing, editing, running, enabling, disabling, and deleting custom detection rules, along with reviewing triggered alerts and response actions. Headings, an anchor, and the publication date were also updated.

Microsoft Defender XDR Advanced hunting API

Hunting and detection

The documentation states that the Defender XDR advanced hunting API is transitioning to the Microsoft Graph security API, with retirement beginning in January 2026.

Microsoft Security Copilot advanced hunting query assistant

Hunting and detection

The page now refers to Security Copilot’s Threat Hunting Assistant and explains how to run a generated query, add it to the editor for review, and view its logic. Screenshots, image descriptions, feedback wording, and the page date were also updated.

Run KQL queries on the Microsoft Sentinel data lake

Hunting and detection

The documentation now describes running long-running KQL queries asynchronously, including queries that may exceed the 8-minute synchronous timeout. It also clarifies external-table examples, time-range requirements for stored results, and adds `estimate_data_size()`.

Sample KQL queries for Microsoft Sentinel data lake

Hunting and detection

The article now describes its audience and query coverage more clearly, including threat detection, anomaly identification, baseline creation, and IOC matching. It also updates Microsoft Entra ID terminology, refines the CommonSecurityLog example, and improves section wording and formatting.

Sentinel Hunting Rules Creation

Hunting and detection

The documentation adds sample hunting queries and a template, updates validation guidance, supports ATT&CK Framework v16, and limits queries to five tactics. Names may be up to 100 characters, must use ASCII, and analytic-rule-only fields can cause review failure.

Threat Explorer Threat Hunting

Hunting and detection

The article removed the “Additional threat hunting and response capabilities” heading, its introductory text, and its anchor, replacing them with a “Related content” heading.

Understand the advanced hunting schema

Hunting and detection

The schema reference now lists CallActivityEvents, corrects the FileMaliciousContentInfo link, and standardizes the GraphAPIAuditEvents name.

Use custom functions in advanced hunting

Hunting and detection

The page title, publication date, screenshot descriptions, parameter wording, tabular-parameter text, and the “See also” heading were revised.

Custom Detection Rules

Hunting and detection

The supported table list now spells `ABAPAuditLog_CL` correctly, fixing a missing “L.”

Threat Explorer Threat Hunting

Hunting and detection

Updated Microsoft Defender documentation in defender-office-365/threat-explorer-threat-hunting.md.

Advanced Hunting Errors

Hunting and detection

Updated Microsoft Defender documentation in defender-xdr/advanced-hunting-errors.md.