Summary

Now, you have learned about how to start doing threat hunting in Microsoft Sentinel. You learned about the Hunting page, the Notebooks page with its Jupyter notebooks, and got a brief introduction on how to perform a threat-hunting investigation.

We looked at the tools that Microsoft Sentinel provides to assist with threat hunting. This includes queries that only get run periodically, either due to factors such as needing to look for a specific piece of information or the fact that they would return too many results to be useful on a scheduled basis.

Another tool that can be used is the hosted instances of Jupyter notebooks. These notebooks allow you to combine text and code into one location to make hunting easier and repeatable. In addition, notebooks can query not only Microsoft Sentinel logs but also third-party information using programming languages, including PowerShell and Python.

In the next chapter, we will look at using Microsoft Sentinel playbooks to help...