Run interactive KQL queries in advanced hunting
Analysis / inference: Advanced Hunting in the Defender portal now supports interactive KQL queries against Microsoft Sentinel data lake sources.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Sentinel - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft added support for interactive Kusto Query Language execution on data lake storage through the Advanced Hunting menu under Investigation and Response in the Defender portal.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisThis feature unifies cross-platform threat hunting by letting SOC analysts execute interactive KQL queries against Microsoft Sentinel data lake tables directly inside the Microsoft Defender portal.
Analysts can investigate telemetry from both Microsoft Sentinel and Microsoft Defender XDR in a single user interface without context switching.
Section 03 · Recommended actions
- Navigate to the Advanced Hunting page in the Microsoft Defender portal to test KQL queries against Sentinel datasets.
- Confirm access to Advanced Hunting under Investigation and Response in the Microsoft Defender portal
- Verify visibility of Microsoft Sentinel data lake tables in the Advanced Hunting interface