> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Run Hunting Query

Query a specified set of events, activities, or entity data to look for specific threats in the environment.

**Least privileged** Microsoft Graph permissions to access the action via **application**: `ThreatHunting.Read.All`.

<Note>
  External Documentation

  To learn more, visit the [Microsoft Defender XDR documentation](https://learn.microsoft.com/en-us/graph/api/security-security-runhuntingquery?view=graph-rest-1.0\&tabs=http).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter  | Description                                                                                                                                                                                       |
  | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | End Time   | The end time of the query. <br /><br />When specified without `Start Time` value the start time will be 30 days before the end time. If none is specified, the timespan will be the last 30 days. |
  | Query      | The hunting query in Kusto Query Language (KQL).                                                                                                                                                  |
  | Start Time | The start time of the query.<br /><br />When specified without `End Time` value, the end time will be 30 days after the start time. If none is specified, the timespan will be the last 30 days.  |
</div>

## Example Output

```json theme={"dark"}
{
	"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.security.huntingQueryResults",
	"schema": [
		{
			"name": "Timestamp",
			"type": "DateTime"
		},
		{
			"name": "FileName",
			"type": "String"
		},
		{
			"name": "InitiatingProcessFileName",
			"type": "String"
		}
	],
	"results": [
		{
			"Timestamp": "2024-03-26T09:39:50.7688641Z",
			"FileName": "cmd.exe",
			"InitiatingProcessFileName": "powershell.exe"
		},
		{
			"Timestamp": "2024-03-26T09:39:49.4353788Z",
			"FileName": "cmd.exe",
			"InitiatingProcessFileName": "powershell.exe"
		}
	]
}
```

## Workflow Library Example

[Run Hunting Query with Microsoft Defender Xdr and Send Results Via Email](https://library.blinkops.com/workflows/run-hunting-query-with-microsoft-defender-xdr-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/run-hunting-query-with-microsoft-defender-xdr-and-send-results-via-email/canvas" />
</div>