Run Hunting Query - BlinkOps Documentation

Query a specified set of events, activities, or entity data to look for specific threats in the environment. Least privileged Microsoft Graph permissions to access the action via application: ThreatHunting.Read.All.

External DocumentationTo learn more, visit the Microsoft Defender XDR documentation.

Parameters

Parameter	Description
End Time	The end time of the query. When specified without `Start Time` value the start time will be 30 days before the end time. If none is specified, the timespan will be the last 30 days.
Query	The hunting query in Kusto Query Language (KQL).
Start Time	The start time of the query. When specified without `End Time` value, the end time will be 30 days after the start time. If none is specified, the timespan will be the last 30 days.

Example Output

{
	"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.security.huntingQueryResults",
	"schema": [
		{
			"name": "Timestamp",
			"type": "DateTime"
		},
		{
			"name": "FileName",
			"type": "String"
		},
		{
			"name": "InitiatingProcessFileName",
			"type": "String"
		}
	],
	"results": [
		{
			"Timestamp": "2024-03-26T09:39:50.7688641Z",
			"FileName": "cmd.exe",
			"InitiatingProcessFileName": "powershell.exe"
		},
		{
			"Timestamp": "2024-03-26T09:39:49.4353788Z",
			"FileName": "cmd.exe",
			"InitiatingProcessFileName": "powershell.exe"
		}
	]
}

Workflow Library Example

Run Hunting Query with Microsoft Defender Xdr and Send Results Via Email

Preview this Workflow on desktop

Microsoft Defender XDR Custom Action Subscribe To Webhook

⌘I

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example