Azure Sentinel hunting

Sentinel Hunting → query custom KQL

Runs custom hunting queries in Microsoft Sentinel, hunting anomalous activity in Azure and environment data.

Use it when you need to hunt over Sentinel's centralized data: Hunting mode lets you run your own KQL queries (or community ones) against tables — AzureActivity, SigninLogs, SecurityEvent, DeviceEvents — to hunt for patterns: service account logons, resource creation operations in the middle of the night, unusual account activity. It's Azure hunting at its finest: you write the custom query, run it, and save results as bookmarks (and turn them into analytic rules if they confirm a pattern). In an Azure SOC, hunting in Sentinel is the proactive search that automated rules don't cover.

Don't use it without data in the workspace: hunting queries return empty if sources aren't connected (Azure AD, Activity Log, host connectors) — connector setup is a prerequisite. Poorly written queries (wrong fields, KQL syntax errors) give empty results or noise: validate against known data before trusting. And watch out for cost and performance: queries over wide ranges of large tables are expensive — narrow the time range and choose tables wisely. Hunting is a process, not a query: review results with context and turn confirmed patterns into rules — a standalone query without follow-up adds nothing.