← Back to the guide

Defender XDR advanced hunting workshop

6slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M

solvingmicrosoft365.com

1 / 6

Defender XDR advanced hunting workshop

How to use Defender XDR advanced hunting effectively — tables, common queries, and threat-hunting patterns.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-xdr-advanced-hunting

Slide 1Download PNG

M

solvingmicrosoft365.com

2 / 6

01

The hunting surface

Access at security.microsoft.com → Hunting → Advanced hunting. Features:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-xdr-advanced-hunting

Slide 2Download PNG

M

solvingmicrosoft365.com

3 / 6

02

Key tables

Each Defender product contributes tables:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-xdr-advanced-hunting

Slide 3Download PNG

M

solvingmicrosoft365.com

4 / 6

03

Common hunting patterns

### Find processes spawned by Office apps

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-xdr-advanced-hunting

Slide 4Download PNG

M

solvingmicrosoft365.com

5 / 6

04

Hunting methodology

Effective hunting isn't ad-hoc; it follows patterns:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-xdr-advanced-hunting

Slide 5Download PNG

M

solvingmicrosoft365.com

6 / 6

05

Operational discipline

For SOC teams using Defender XDR seriously, advanced hunting is one of the most valuable capabilities. KQL is learnable in days; mastery takes longer; the payback is continuous.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-xdr-advanced-hunting

Slide 6Download PNG

Auto-generated from Defender XDR advanced hunting workshop. This page is not indexed and isn't part of the guide itself.