SC-200 threat hunting explained
Perform threat hunting is worth 20–25% of SC-200 and is about looking for threats that no detection has caught yet. It is the smallest domain, but it asks the most of your KQL, and the same skills sit behind custom detections and analytics rules in the first domain. The outline splits it into hunting with Microsoft Defender XDR and hunting on the Microsoft Sentinel platform.
Detect threats with Defender XDR
The objectives are to identify the right table for a KQL query, identify threats with KQL, create advanced hunting queries, interpret threat analytics, create hunting graphs including blast radius, and analyze relationships between entities with Sentinel Graph.
Advanced hunting
Advanced hunting is a query interface over the raw tables of Defender XDR. The tables are grouped by product, so most of the skill is knowing where a signal lives:
| Question | Table family |
|---|---|
| What processes ran on a device? | DeviceProcessEvents |
| Which device connected to which address? | DeviceNetworkEvents |
| Who logged on to a device? | DeviceLogonEvents |
| Which files were created or changed? | DeviceFileEvents |
| What mail arrived and what was its verdict? | EmailEvents, EmailAttachmentInfo, EmailUrlInfo |
| Cloud app activity? | CloudAppEvents |
| Directory and identity logons? | IdentityLogonEvents |
Threat analytics
Threat analytics is Microsoft’s reporting on active threat campaigns and techniques. It shows whether you are exposed and affected, which devices lack the mitigations, and gives hunting queries to run. In a scenario, it is the answer when the question is whether a newly reported threat affects the organisation.
Hunting graphs and blast radius
Hunting graphs visualise relationships between entities. The blast radius view shows what a compromised entity could reach, which helps you decide how far containment must extend. Sentinel Graph analyzes relationships between entities across the data in the Sentinel platform.
Detect threats with the Sentinel platform
- Hunting queries: create, run and monitor queries; bookmark results and promote findings to incidents; convert a good hunting query into an analytics rule.
- KQL jobs in the data lake: run a query over large volumes of data in the lake tier and write the results into a table you can use in the analytics tier. This is how you search months of cheaply stored data.
- Summary rules: aggregate high-volume data into compact summary tables on a schedule, so later queries are fast and cheap.
- Notebooks: use Jupyter-style notebooks for deeper analysis, including connection to the Sentinel MCP Server.
Hunting method
A useful structure for scenario questions:
- Start with a hypothesis, for example an attacker using a stolen token from an unfamiliar country.
- Choose the table that holds the evidence.
- Query, then narrow and pivot on entities such as the account or device.
- If it finds something real, raise an incident or create a detection so the next occurrence is caught automatically.
Example questions
Question 1. A new report describes a campaign abusing a particular technique. You want to know quickly whether your devices are exposed and affected, with ready-made hunting queries. Where do you look first in Defender XDR?
- A. A device timeline
- B. A Sentinel workbook
- C. The ASR rules report
- D. Threat analytics
Show answer
Answer: D
Threat analytics reports describe active threats, show impacted and exposed assets and include hunting queries. A device timeline shows history for one device, not a threat overview. A workbook in Sentinel is a custom dashboard that would have to be built. Attack surface reduction rules prevent behaviours but do not report on a specific campaign.
Want more questions like this? Full SC-200 practice tests →
Question 2. You must search 18 months of rarely used firewall logs kept in the lower-cost data lake tier for one IP address, and then use the matching rows in your normal detections. What should you use?
- A. A summary rule that counts connections per day
- B. A KQL job that writes the matching rows to a table
- C. A workbook with an IP address parameter
- D. A near-real-time analytics rule
Show answer
Answer: B
A KQL job in the data lake runs a query over large volumes of lake data and writes the results to a table in the analytics tier, where normal tooling can use them. A summary rule aggregates data on a schedule and would lose the row-level detail. A workbook visualises data but does not move it. An NRT rule evaluates new data and cannot search 18 months of history.
Want more questions like this? Full SC-200 practice tests →
Question 3. A compromised service account is identified. You want to see which other devices and identities it could reach to decide how far to extend containment. Which capability helps most?
- A. A hunting graph with blast radius
- B. Compliance Manager score
- C. A device timeline for one device
- D. The analytics tier retention setting
Show answer
Answer: A
The blast radius view in hunting graphs shows the relationships and reach of a compromised entity, which informs the scope of containment. Compliance score reports on regulatory posture, not attack reach. A single device timeline shows one device. Retention settings control data storage, not entity relationships.
Want more questions like this? Full SC-200 practice tests →
How to revise this domain
Run every query you read about. Take one of the example hunts, such as rare parent-child process pairs, and run it in a lab tenant. Then rewrite it for the Sentinel tables. The KQL guide lists the operators worth drilling.
Next, see the exam tips or attempt the practice test.