Summary

Now, you have learned about how to start doing threat hunting in Azure Sentinel. You learned about the Hunting page and the Notebooks page with its Jupyter Notebooks, and got a brief introduction on how to perform a threat-hunting investigation.

We looked at the tools that Azure Sentinel provides to assist with threat hunting. This includes queries that only get run periodically, either due to factors such as needing to look for a specific piece of information, or the fact that they would return too many results to be useful on a scheduled basis.

Another tool that can be used is the hosted instances of Jupyter Notebooks. These notebooks allow you to combine text, code, and output into one location to make hunting easier and repeatable. In addition, notebooks can query not only Azure Sentinel logs but also third-party information through the use of programming languages, including F# and Python.

In the next chapter, we will look at using Azure Sentinel playbooks to...