In Microsoft 365 Defender, Advanced Hunting is the dedicated feature for creating and managing custom Kusto Query Language (KQL) queries used to proactively detect threats, investigate suspicious activity, and track ongoing risks across Microsoft 365 services (including Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, and Defender for Office 365).
A custom tracked query is a saved hunting query that continuously assesses your environment's threat status over time. According to Microsoft documentation, you create, edit, and manage these queries under the
"Advanced Hunting" page in the Microsoft 365 Defender portal. The tracked queries appear under the
"Custom detection rules" or "Tracked queries" tabs within this section, depending on their purpose.
Here's how it works:
* Navigate to Microsoft 365 Defender portal # Hunting # Advanced Hunting.
* Use KQL to define your custom query that identifies specific threat patterns or anomalies.
* Save it as a tracked query, allowing Microsoft 365 Defender to run it regularly and surface ongoing results in the hunting dashboard.
Other options are not correct:
* Policies & rules - used for configuration of alerting and security policies, not ad-hoc or proactive hunting.
* Explorer - provides real-time investigation of emails and threats but doesn't support custom KQL queries.
* Threat analytics - offers intelligence-driven insights and reports but doesn't allow creating custom queries.
# Correct answer: D. Advanced Hunting