Hunt Threats with KQL and Promote a Hunt to a Detection Rule in Microsoft Sentinel

Proactive threat hunting is the discipline of seeking out malicious activity that has slipped past automated detections. Instead of waiting for an alert, a hunter forms a hypothesis - "an attacker is brute-forcing sign-ins from a foreign IP" - expresses it as a KQL query, and sweeps historical telemetry for evidence. Microsoft Sentinel turns this into a repeatable workflow: hunters run library and custom hunting queries, bookmark the exact rows that confirm a finding, organize their work around MITRE ATT&CK to expose coverage gaps, and convert a hunt that proves valuable into a standing scheduled analytics rule so the SOC never has to hunt that pattern manually again.

In this lab, you will work in a Microsoft Sentinel workspace pre-seeded with realistic sign-in telemetry. You will explore the seeded data with KQL, save a custom hunting query mapped to a MITRE technique, bookmark a suspicious finding, promote your hunting query into a scheduled analytics rule using the Sentinel wizard, and use the MITRE ATT&CK view to confirm your new hunt and detection improve technique coverage.

Objectives

Upon completion of this advanced level lab, you will be able to:

• Explore pre-seeded sign-in telemetry in Log Analytics with exploratory KQL
• Author and save a custom KQL hunting query mapped to a MITRE ATT&CK technique
• Bookmark a suspicious finding to preserve the row, query, and entity context
• Promote a successful hunting query into a scheduled analytics rule
• Use the MITRE ATT&CK view to confirm hunting-query and detection coverage of a technique

Who is this lab for?

This lab is designed for:

• SOC analysts practicing the proactive hunt-to-detection lifecycle
• Threat hunters who know basic KQL and Sentinel navigation
• Security engineers mapping detection coverage to MITRE ATT&CK