Chapter 3 of 3 · Microsoft SC-200
Perform Threat Hunting
KQL in Defender XDR, threat analytics, hunting graphs, Sentinel hunting, the data lake and notebooks.
- 4topics
- 26 minfast track
- 1diagrams and exhibits
- 20–25%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Hunting with KQL in Defender XDRSC-200 advanced hunting: choosing the right table, KQL operators, example queries for PowerShell, logons and joins, the 30 day…6 min
- 2Threat Analytics and Hunting GraphsSC-200 threat analytics: Defender XDR threat reports, exposure and mitigations, graph based hunting, relationship traversal and…6 min
- 3Sentinel Hunting Queries and the Data LakeSC-200 Sentinel hunting: hunting queries, bookmarks, livestream, data lake exploration, KQL jobs that promote data and summary…7 min
- 4Notebooks, MCP and Sentinel GraphSC-200 deep hunting: Jupyter notebooks and PySpark on the data lake, the Sentinel MCP server and its roles, and Sentinel graph…Diagram7 min
About this chapter
What this chapter covers
Threat hunting is the proactive search for attackers that detections have missed. This domain is worth 20 to 25 percent of the exam. It covers hunting with Kusto Query Language (KQL) in Microsoft Defender XDR, reading threat analytics, graph based hunting, and the hunting tools of Microsoft Sentinel, including the data lake, KQL jobs, summary rules, notebooks and the Sentinel MCP server.
You need to read and write KQL, know which table holds which data, and know which hunting tool suits which question.
How the topics fit together
- Hunting with KQL in Defender XDR covers the advanced hunting tables, KQL operators and example queries.
- Threat analytics and hunting graphs covers reports on emerging threats, graph based hunting and blast radius.
- Sentinel hunting queries and the data lake covers hunting queries, bookmarks, KQL jobs and summary rules.
- Notebooks, MCP and Sentinel graph covers notebooks, the Sentinel MCP server and graph analytics.
Always start from a hypothesis, such as "an attacker is using encoded PowerShell". The hypothesis tells you which table to query.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with examples and tables.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Microsoft SC-200 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.