Advanced hunting

Question 1

How can we use threat hunting quries for atuomated detection?

Answer 1

Threat-hunting rules can be used to create detection rules to autmatically check for and the respond to suspected breach activity, misconfigured machines and other findings.

Question 2

what data sources can be checked by advanced hunting queries?

Answer 2

Microsoft Defender for Endpoint

Microsoft Defender for Office 365

Microsoft Defender for Cloud Apps

Microsoft Defender for Identity

Question 3

What are two types of advanced hunting query data?

Answer 3

Event or activity data
data from alerts, security events, system events, routine assessments.

Entity data
information about users and devices.
static and dynamic sources, AD, event logs.