Most analysts think…
Most SOC analysts treat Microsoft Sentinel as a passive system — wait for an alert, investigate, close the ticket. That is reactive security, and advanced adversaries are counting on it.
Microsoft Sentinel has a full proactive hunting layer: hundreds of built-in KQL queries aligned to MITRE ATT&CK, a bookmark system to save suspicious rows, a livestream that watches for a threat indicator in real time, a structured Hunts workspace for hypothesis-driven campaigns, and Jupyter notebooks backed by MSTICPy for analytics — anomaly detection, timelines, threat-intel enrichment — that KQL alone cannot do. Understanding every layer is what separates a reactive analyst from a proactive hunter.
① Hunting queries — KQL mapped to MITRE ATT&CK
The Hunting blade in the Microsoft Sentinel portal is home to a library of built-in KQL queries — each tagged with a MITRE ATT&CK tactic and technique. You can filter by tactic (Reconnaissance, Persistence, Lateral Movement, Exfiltration, etc.) to focus your hunt on the behaviours most relevant to a threat you suspect or a recent threat-intel report. Each query ships with a description, a data-source tag and a MITRE mapping so you understand what behaviour it surfaces before you run it.
Beyond the built-in library you can write your own KQL hunting queries and save them to the workspace. A good query starts with a hypothesis: 'I believe an attacker has a foothold and is enumerating accounts.' The query operationalises that hypothesis — for example, looking for spikes in AuditLogs for directory reads from a single service principal outside business hours. You run the query, inspect results, and decide whether results warrant a bookmark or an incident.
Tips for effective hunting queries
- Pin the time range to the period of suspected activity — a 30-day look-back catches persistence; a 4-hour window catches active intrusion.
- Use the Entity columns (Account, Host, IP, URL) so results automatically link to entity pages and timelines.
- Clone a built-in query, adjust thresholds, and save it under a custom name — this preserves the MITRE mapping.
In an interview or a real hunt, always name the MITRE ATT&CK tactic that drives your query choice. 'I filtered the Hunting blade to Lateral Movement, found the wmic.exe abuse query, and ran it over 14 days of logs' is a far stronger answer than 'I ran some queries'.
What is the primary organisational axis for hunting queries in the Sentinel Hunting blade?
② Bookmarks and livestream — saving and watching in real time
Bookmarks are how you capture a suspicious query result row without immediately creating an incident. When a hunting query returns a row that looks anomalous — an unexpected outbound connection, a rare process parent-child pair — you right-click and bookmark it. Bookmarks carry the query context, entity mappings, MITRE technique and your analyst notes forward. You can then: promote a bookmark to a new incident, add it to an existing incident, or surface it in the investigation graph to connect the dot to other entities.
Livestream takes a hunting query and runs it continuously against incoming log data, alerting you the moment a match lands. It is real-time monitoring scoped to a specific hypothesis — ideal when you know a threat actor uses a particular tool or technique and you want an immediate signal if that behaviour appears. Unlike an analytics rule, a livestream is manual and temporary: you start it, watch it during the hunt session, and stop it when the hypothesis is resolved.
Together, bookmarks and livestream give you a workflow: run a query over historical data, bookmark suspicious rows, then flip on a livestream to catch new occurrences as they happen. Both feed the same Sentinel workspace so evidence stays in one place.
A KQL query in the Sentinel Hunting blade, tagged with a MITRE ATT&CK tactic and technique, run manually by an analyst to surface suspicious behaviour over historical log data.
A saved pointer to a suspicious query result row. Bookmarks carry entity mappings, MITRE technique and analyst notes forward and can be promoted to incidents or added to existing investigations.
A real-time query monitor that runs a hunting query continuously against incoming log data and alerts the analyst the moment a new match lands — temporary, manual, hypothesis-scoped.
Microsoft Threat Intelligence Center Python library for Sentinel notebooks: queries Log Analytics via KQL, enriches entities with threat intel and geolocation, detects anomalies, and renders interactive timelines.
If you close a hunting query tab without bookmarking suspicious rows, the result set is gone. There is no auto-save of query results. Always bookmark first — even if you are 70% sure the row is benign — so you can revisit it from the Bookmarks view without re-running.
You spot a suspicious process parent-child pair in a hunting query result. What is the correct next step before creating an incident?
③ Hypothesis-driven hunts — the Hunts workspace
The Hunts feature (in the Threat Management section of the Sentinel portal) provides a structured workspace for running a full end-to-end threat hunting campaign. You create a Hunt by giving it a name, a hypothesis statement (e.g. 'Attacker is using living-off-the-land binaries for lateral movement after an initial phishing compromise'), and optionally linking it to a MITRE tactic or technique. The hypothesis status can be set to Unconfirmed, Partially Validated, Confirmed True, or Confirmed False as evidence accumulates.
Inside a Hunt you add hunt queries — either from the built-in library or custom ones you wrote. As you run those queries and find suspicious rows you bookmark them directly into the Hunt, keeping all evidence together. The Hunts workspace tracks metrics: how many queries were run, how many bookmarks were taken, how many incidents were created from this campaign. This is the 'show your work' paper trail that threat hunting teams need for reporting and for MITRE coverage dashboards.
The workflow is: hypothesis → attach queries → run and bookmark → update hypothesis status → promote to incident if confirmed. When the hunt is closed, all bookmarks and the hypothesis record remain linked, so you can revisit or share the full investigation.
Priya at a Mumbai financial services firm faces this
The security team receives a threat-intel report: a ransomware group is using living-off-the-land binaries (LOLBins) — specifically wmic.exe and certutil.exe — for lateral movement. No Sentinel analytics rule currently fires for this behaviour.
The team has no structured hunting campaign; analysts run ad-hoc queries but findings are lost in personal notes and never linked to incidents.
Open the Hunts workspace — there is no active hunt for this behaviour. Filter the Hunting blade by the Lateral Movement tactic: find built-in queries for wmic and certutil abuse. Running them shows process executions across several hosts in the past 14 days that look anomalous.
Sentinel portal ▸ Threat Management ▸ Hunting + Threat Management ▸ HuntsCreate a new Hunt: hypothesis = 'LOLBin lateral movement active after phishing'. Attach the wmic and certutil queries, run them, bookmark suspicious rows. Update hypothesis status to Partially Validated. Promote highest-confidence rows to a new incident for IR. Flip on a Livestream for certutil.exe spawned by Office to catch new occurrences.
The Hunt workspace shows: 2 queries run, 7 bookmarks taken, 1 incident raised, hypothesis status = Confirmed True. Livestream alerts when a fresh certutil execution hits the ingestion pipeline — caught in real time.
▶ Watch a LOLBin lateral-movement hypothesis become a confirmed incident
Step through how a structured hunt turns a threat-intel tip into a validated finding. Press Play for the healthy path, then Break it to see the common failure.
What distinguishes the Hunts workspace from simply running individual hunting queries?
④ Jupyter notebooks and MSTICPy — analytics beyond KQL
Microsoft Sentinel is integrated with Azure Machine Learning (AML) compute so you can launch a Jupyter notebook directly from the portal — the workspace credentials, workspace ID and tenant are passed automatically. The notebook opens with access to the same Log Analytics data via the MSTICPy library (Microsoft Threat Intelligence Center Python), which wraps KQL queries, entity enrichment, threat-intel lookups, and visualisation functions in Python.
MSTICPy adds layers that KQL alone cannot deliver: anomaly detection on time-series log data, geolocation and IP enrichment from MaxMind or Microsoft, WHOIS lookups, VirusTotal integration, interactive process-tree and timeline visualisations, and MITRE ATT&CK technique heatmaps across a Sentinel workspace. The MITRE Map notebook, for example, uses a language model to map free-text incident descriptions onto ATT&CK Enterprise techniques — useful for coverage-gap analysis.
When to use a notebook vs a KQL query
- Use KQL for fast, repeatable detection and hunting queries that need to run at scale.
- Use a notebook when you need multi-step Python logic, ML models, external API calls, or interactive visuals for a deep-dive investigation.
- Notebooks are not a replacement for analytics rules or hunting queries — they are the deep-investigation layer when you need statistical power or enrichment that the portal UI cannot provide.
Before writing any MSTICPy analytics, run the workspace connection cell and confirm it returns the expected Log Analytics workspace ID and row count. A misconfigured AML compute or stale token is the most common reason notebooks appear to run but silently return empty dataframes.
When should a Sentinel analyst use a Jupyter notebook with MSTICPy instead of a KQL hunting query?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: what is the difference between a Sentinel Livestream and a scheduled analytics rule? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Hunting query
- A KQL query run manually in the Sentinel Hunting blade, tagged with a MITRE ATT&CK tactic and technique, used to proactively search for adversary behaviour in historical log data.
- Bookmark
- A saved pointer to a specific hunting query result row, carrying entity mappings, MITRE technique and analyst notes, which can be promoted to an incident or added to an investigation.
- Livestream
- A real-time query monitor in Sentinel that continuously evaluates a hunting query against incoming log data and alerts the analyst immediately when a new match lands.
- Hunts workspace
- A Sentinel feature that structures a threat-hunting campaign around a hypothesis, attached queries, bookmarks and outcome metrics (queries run, bookmarks taken, incidents raised).
- MSTICPy
- Microsoft Threat Intelligence Center Python library for Sentinel Jupyter notebooks, providing KQL data access, threat-intel enrichment, anomaly detection and interactive security visualisations.
- MITRE ATT&CK
- A globally-adopted adversary-behaviour framework. Tactics are adversary goals (e.g. Lateral Movement); techniques are specific methods to achieve them. Sentinel hunting queries are tagged with both.
- Hypothesis
- In the context of threat hunting, a testable theory about adversary behaviour (e.g. 'attacker is using LOLBins for lateral movement') that drives query selection and directs the hunt.
- LOLBin
- Living-Off-the-Land Binary — a legitimate Windows binary (e.g. certutil.exe, wmic.exe) abused by attackers for malicious actions such as downloading payloads or lateral movement, because it evades signature-based detection.
📚 Sources
- Microsoft Learn — Hunting capabilities in Microsoft Sentinel. learn.microsoft.com/azure/sentinel/hunting
- Microsoft Learn — Conduct end-to-end threat hunting with Hunts in Microsoft Sentinel. learn.microsoft.com/azure/sentinel/hunts
- Microsoft Learn — Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel. learn.microsoft.com/azure/sentinel/notebook-get-started
- Microsoft Tech Community — Top 5 Microsoft Sentinel Queries for Threat Hunting. techcommunity.microsoft.com/blog/microsoftsentinelblog
- GitHub: Azure/Azure-Sentinel-Notebooks — MITRE Map notebook README. github.com/Azure/Azure-Sentinel-Notebooks
- Microsoft Learn — Perform threat hunting in Microsoft Sentinel (SC-200 training path). learn.microsoft.com/training/paths/sc-200-perform-threat-hunting-azure-sentinel
What's next?
Got hunting covered? Next, go deep on Microsoft Sentinel analytics rules — scheduled, ML-based Fusion, anomaly, and NRT rules — to turn hunt findings into automated detections.