Threat Hunting Assistant in advanced hunting
👋 Introduction
Now that Security Copilot slowly gets activated in all M365 E5 tenants, people get access to all the great Security Copilot Agents. The Threat Hunting Assistant is one of these agents, making Advanced hunting in Defender XDR much easier for IT and security teams.
The agent helps you investigate threats using natural language instead of requiring any KQL knowledge. It supports the full investigation process by generating queries, explaining results, highlighting relevant findings and helping analysts move from questions to actions more efficiently.
Key capabilities of the Threat Hunting Agent
- Natural language hunting: Ask questions in plain English and get answers with KQL and results.
- Context-aware conversations: Supports follow-up questions and maintains context.
- Schema-aware queries: Uses your available tables, including custom tables.
- Adaptive investigation: Refines queries based on results.
- Insights & visualizations: Provides observations, charts, and contextual findings.
- Smart recommendations: Suggests next investigation and remediation steps.
- Integrated experience: Generates KQL and displays results directly in Advanced Hunting.
🏹 Threat Hunting
To get started with the Threat Hunting Assistant, go to the Defender portal and open Advanced hunting.
Defender portal -> Investigation & response -> Hunting -> Advanced hunting
If you have not opened Advanced hunting recently, you will see a pop-up window informing you about the new agent and how to access it.
 |  |
|---|---|
 |  |
You can start the chat with the agent by clicking Threat hunting assistant.
The Threat Hunting Assistant opens in the right-side pane.
To get the best results from the agent, ask clear, unambiguous questions one at a time and provide specific details about the data you are looking for.
INFO
Instead of using a fixed list of tables, the Threat Hunting Assistant discovers available data, including custom tables in your workspace, by listing your accessible tables, inspecting relevant schemas, and selecting or joining the necessary tables to answer your question, all while operating under read-only permissions that match your existing advanced hunting access.
The Threat Hunting Assistant has two modes, which you can switch between by clicking the three dots in the top-right corner of the agent pane. You can also switch directly to the Security Analyst Agent from here.
| Mode | Best For | Output |
|---|---|---|
| Rich insights | End-to-end investigations, multi-step hunting, and threat analysis | Answers, KQL queries, results, insights, and recommendations |
| Query only | Generating KQL queries from natural language | KQL query with explanation |
Rich insights is the default mode and only one mode can be active at a time. The active mode is displayed as a badge next to Threat hunting assistant at the top of the side pane.
INFO
- Mode selection is only available in primary workspaces.
- Switching modes starts a new chat and clears the current conversation.
Rich Insights
Getting started is as easy as selecting a prebuilt query from Copilot when you open it or typing your request into the chat.
You can ask the agent about any scenario that can be analysed using the existing data, such as:
- Investigating alerts and incidents
- Investigating signs of compromise
- Reviewing the impact of an attack
- Testing security theories
The agent then generates a KQL query and runs it automatically, providing the results and adding insights in the side pane.
At the top, you can see the generated KQL query, with the results in the bottom pane. The agent also provides a visualization of the results directly above the results table.
 |  |
|---|
It provides a natural-language response to your question, including insights and recommendations.
You can also select See the logic behind the query in the side pane to understand how the query was built and what data was used to generate the results.
Once you have received a response, you can continue the session by asking follow-up questions, requesting query adjustments, or selecting one of the agent's suggested actions. You can also work with the KQL query directly in the query editor, just as you would if you had built it yourself.
INFO
Providing feedback in the portal by selecting the feedback icon helps improve accuracy of the agent for the future.
Query only
When you switch to Query only mode, the agent generates only a KQL query from your natural-language request. Unlike Rich insights mode, the agent does not run the query directly or provide additional insights or recommendations. You can still select See the logic behind the query to gain insight into how the query was built and what data was used to generate the results.
You can select Run query to add the query to the editor and run it automatically. Alternatively, open the drop-down menu and choose to add the query to the editor without running it.
💡 Conclusion
The Threat Hunting Assistant is a powerful tool for organizations looking to strengthen their security posture and investigate threats more efficiently. Its ability to generate KQL queries, explain results, and provide actionable insights makes it a valuable addition to your security toolkit. By combining natural-language requests with your existing Advanced hunting data and permissions, it helps analysts move from questions to informed actions more quickly.
References