Query ADX Data from Defender Advanced Hunting

Azure Data Explorer is amazing storage for temporary data, for instance forensic artefacts and other structured data

To have access to this data from Defender Advanced Hunting is amazing capability

use the function adx() to access your data cluster and join the data together with the hunting data available in Defender XDR

Use Microsoft Sentinel custom functions in advanced hunting in Microsoft Defender – Microsoft Defender XDR | Microsoft Learn

Happy Hunting!

Leave a Comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.