Tag Archive: Enrich

Query ADX Data from Defender Advanced Hunting

Azure Data Explorer is amazing storage for temporary data, for instance forensic artefacts and other structured data

To have access to this data from Defender Advanced Hunting is amazing capability

use the function adx() to access your data cluster and join the data together with the hunting data available in Defender XDR

Use Microsoft Sentinel custom functions in advanced hunting in Microsoft Defender – Microsoft Defender XDR | Microsoft Learn

Happy Hunting!