Create and Manage Microsoft Sentinel Hunts – SC-200 Study Guide

Purpose of This Lesson

Microsoft Sentinel hunting is the analyst-driven process of proactively searching for suspicious activity that automated detections may not have identified. A hunt is different from an incident or analytics rule: the analyst initiates it, defines the investigation question, runs queries, evaluates evidence, and records the conclusion.

This workflow is useful when investigating emerging threats, unusual behavior, gaps in automated detection, or a hypothesis generated from threat intelligence.

Key Concepts

Hunting versus automated detection

• Incidents are generally reactive. They are created from signals such as analytics rules or Microsoft Defender detections.
• Analytics rules evaluate data automatically and can generate alerts or incidents when their conditions are met.
• Hunts are proactive and manually initiated by a security analyst.
• A hunt can search for patterns that have not yet been converted into an automated detection or that existing detections failed to identify.

Examples of hunting questions include:

• Are there unusual sign-in failures across the environment?
• Is a suspicious IP address associated with multiple accounts?
• Is a device exhibiting behavior that does not match its normal pattern?
• Are there signs of a threat described in recent threat intelligence?

Hunting workspace capabilities

The Microsoft Sentinel hunting area supports several parts of the investigation process:

• New hunt: Creates a structured hunting session with metadata, a hypothesis, and queries.
• Live streams: Displays matching events as they arrive, using a live KQL query. This can help monitor activity such as authentication failures in near real time.
• Bookmarks: Saves notable events or records for later review and correlation.
• Queries: Provides the location for hunting queries used to search connected data.

Hunt metadata

When creating a hunt, document the investigation clearly rather than treating it as an informal search. Important fields include:

• Name: A concise description of the behavior being investigated, such as Suspicious sign-in spike.
• Description: The question, scope, and reason for the hunt.
• Owner: The analyst or team responsible for the investigation.
• Status: The current workflow state.
• Hypothesis: The analyst’s current conclusion about whether the suspected behavior is malicious.

Hunt status values

The lecture identifies the following status values:

Status	Meaning
New	The hunt has been created or is just beginning.
Active	The investigation is currently in progress.
Closed	The investigation is complete and findings are being finalized.
Backlog	The hunt is planned but will be performed later.
Approved	The hunt has been reviewed and approved by a lead analyst or leadership.

Status describes the workflow state, not whether the hypothesis was proven. A hunt can be active while the analyst is still gathering evidence, regardless of whether the eventual result will be validated or invalidated.

Hypothesis values

The hypothesis records the investigation’s conclusion:

• Unknown: The hunt has started, but the analyst does not yet know whether the behavior is malicious.
• Validated: The suspicion was confirmed; the evidence supports malicious activity.
• Invalidated: The investigation found a legitimate explanation or otherwise disproved the malicious hypothesis.

For example, an impossible-travel sign-in pattern might initially be unknown. If investigation shows that the activity came from an authorized corporate VPN, the hypothesis can be marked invalidated. If evidence confirms unauthorized access, it can be marked validated.

Microsoft Security Operations Context

Hunting is one part of a broader SOC workflow:

1. Define a behavioral question or hypothesis.
2. Create a hunt with a clear name, description, owner, and initial state.
3. Use KQL queries to search relevant Sentinel data.
4. Review suspicious records and bookmark important evidence.
5. Refine the investigation using additional queries or live monitoring when appropriate.
6. Record whether the hypothesis was validated or invalidated.
7. Close the hunt and document findings, follow-up actions, and any detection improvements.

A successful hunt may produce more than a conclusion. If the behavior is repeatedly relevant, the analyst may recommend an analytics rule or another long-term detection so that future occurrences can be detected automatically.

Tool / Feature Decision Guide

Need	Sentinel capability	Why choose it
Proactively investigate a suspected behavior	New hunt	Creates an analyst-driven investigation rather than waiting for an incident.
Observe matching events as they occur	Live stream	Supports near-real-time monitoring with a live KQL query.
Preserve a notable event for later analysis	Bookmark	Keeps an interesting record available for review and correlation.
Search historical or connected security data	Hunting query	Allows the analyst to test a hypothesis against available data.
Record the investigation outcome	Hypothesis field	Indicates whether the suspicion remains unknown, was validated, or was invalidated.
Track investigation workflow	Hunt status	Separates planning, approval, active work, and completion.

KQL Notes

Hunting queries use Kusto Query Language (KQL) to search Sentinel data. The important exam distinction is that a hunt is an analyst-initiated investigation, while a live stream is used to watch results from a query as new events arrive.

A simple conceptual example is a live KQL search for authentication failures. The exact table and field depend on the connected data source, so analysts should confirm the available schema before writing the query. Do not assume that every tenant has identical tables, fields, or retention.

Exam-Relevant Takeaways

• Choose hunting when the analyst wants to proactively investigate behavior that automated detections may have missed.
• Do not confuse a hunt with an automatically generated incident or analytics-rule alert.
• Live streams are for observing query results in real time; they do not replace a structured hunt record.
• Bookmarks preserve interesting events during investigation.
• New, active, backlog, approved, and closed describe hunt workflow status.
• Unknown, validated, and invalidated describe the current conclusion about the hypothesis.
• A legitimate explanation, such as an authorized VPN, can invalidate an apparently suspicious sign-in pattern.
• Hunt metadata matters: name, description, owner, status, and hypothesis provide accountability and investigation context.

Common Exam Traps

• Trap: Treating a hunt as an incident. A hunt is initiated by the analyst; an incident is normally generated from detection signals.
• Trap: Confusing status with hypothesis. Active means work is in progress. It does not mean the activity is malicious. Validated means the suspicion was confirmed.
• Trap: Marking a hypothesis validated too early. A suspicious pattern is initially Unknown until evidence supports a conclusion.
• Trap: Using a bookmark as the investigation itself. A bookmark preserves an interesting record; it does not replace the hunt, query, or final documentation.
• Trap: Assuming every anomaly is malicious. Legitimate VPN use or other approved organizational activity may explain a suspicious-looking pattern and result in an invalidated hypothesis.

Real-World SOC Analyst Notes

• Write the hunt description as a testable question, including the time range, data sources, and suspected behavior.
• Assign an owner so another analyst knows who is responsible for follow-up and closure.
• Preserve useful evidence with bookmarks before changing filters or moving to another query.
• Keep the hypothesis Unknown while evidence is incomplete; premature conclusions can bias the investigation.
• Treat live monitoring carefully. A live stream can generate a large volume of events and contribute to analyst fatigue if the query is too broad.
• If a hunt confirms malicious activity, preserve relevant evidence, document the reasoning, and coordinate escalation through the incident-response process.
• If a hunt repeatedly identifies the same actionable pattern, consider whether a formal analytics rule should be developed after tuning and change review.
• Validate legitimate explanations with the appropriate identity, network, or endpoint teams rather than dismissing an anomaly without evidence.

Quick Reference Summary

• Hunt: Analyst-initiated proactive investigation.
• Incident: Reactive investigation created from detection signals.
• Live stream: Watches query results as events arrive.
• Bookmark: Saves an interesting event for later analysis.
• Status: Tracks workflow, such as new, active, backlog, approved, or closed.
• Hypothesis: Tracks the conclusion: unknown, validated, or invalidated.
• Best practice: Document the question, owner, evidence, conclusion, and follow-up action.

Flashcards

Q: When should a SOC analyst create a Microsoft Sentinel hunt instead of waiting for an incident?
A: Create a hunt when proactively investigating a suspicious behavior, threat-intelligence hypothesis, or detection gap that may not have triggered an automated alert or incident.

Q: What is the decisive difference between a Sentinel hunt and an incident?
A: A hunt is initiated and structured by the analyst, while an incident is generally created reactively from analytics-rule or Defender signals.

Q: Which Sentinel feature should you use to watch authentication failures as new events arrive?
A: Use a live stream with a live KQL query because it is designed to display matching events in near real time.

Q: When would you use a bookmark during a hunt?
A: Use a bookmark when a record, IP address, sign-in, or other event is important enough to preserve for later review and correlation.

Q: What is the difference between a hunt’s status and its hypothesis?
A: Status describes workflow progress, such as active or closed. Hypothesis describes the investigation’s conclusion, such as unknown, validated, or invalidated.

Q: A newly created hunt has not produced enough evidence to determine whether activity is malicious. Which hypothesis should be selected?
A: Select Unknown because the investigation is incomplete and the suspicion has not yet been proven or disproven.

Q: When should a hunt hypothesis be marked invalidated?
A: Mark it invalidated when investigation disproves the malicious explanation, such as when an apparent impossible-travel pattern is explained by an authorized corporate VPN.

Q: What does a validated hunt hypothesis mean?
A: It means the investigation confirmed that the suspected activity is malicious or otherwise supports the original suspicion.

Q: Which status indicates that a hunt is planned but not yet being performed?
A: Backlog indicates that the hunt is scheduled or intended for later rather than currently active.

Q: Which status indicates that a lead analyst or leadership has reviewed and approved a hunt?
A: Approved indicates that the hunt has passed the required review before execution.

Q: Why should a hunt have a clear name and description?
A: They communicate the investigation question and scope, making the work understandable, repeatable, and easier to hand off or audit.

Q: What should an analyst do if a hunt repeatedly confirms the same actionable behavior?
A: Consider developing a tuned analytics rule so future occurrences can be detected automatically, subject to review and change control.

Practice Questions

Question 1

A SOC analyst suspects that an emerging attack technique is present but no existing analytics rule has generated an incident. Which Sentinel capability is the best starting point?

• A. Create a new hunt
• B. Close an existing incident
• C. Create a bookmark without a query
• D. Mark the hypothesis as validated

Correct answer: A. Create a new hunt.

A hunt is the analyst-driven mechanism for proactively investigating suspicious behavior that automated detections may have missed. A bookmark can preserve evidence, but it does not establish the investigation.

Question 2

An analyst creates a hunt for an unusual sign-in pattern. The investigation is still collecting evidence, and there is no confirmed malicious activity. Which combination is most appropriate?

• A. Status: Closed; hypothesis: Validated
• B. Status: Active; hypothesis: Unknown
• C. Status: Backlog; hypothesis: Invalidated
• D. Status: Approved; hypothesis: Validated

Correct answer: B. Status: Active; hypothesis: Unknown.

The hunt is in progress, so its workflow status is active. Because the evidence is not yet conclusive, the hypothesis remains unknown.

Question 3

A live KQL search identifies a suspicious sign-in record. The analyst wants to retain that specific event while continuing to investigate other records. What should the analyst use?

• A. A bookmark
• B. The backlog status
• C. The approved status
• D. An invalidated hypothesis

Correct answer: A. A bookmark.

Bookmarks preserve notable events discovered during hunting so they can be reviewed or correlated later. They do not determine the hunt’s final conclusion.

Question 4

An impossible-travel hunt finds sign-ins from distant locations, but the identity team confirms that the user was connected through an authorized corporate VPN. What is the appropriate conclusion?

• A. The hypothesis is validated
• B. The hypothesis remains automatically validated because the pattern was suspicious
• C. The hypothesis is invalidated
• D. The hunt must be moved to backlog

Correct answer: C. The hypothesis is invalidated.

The investigation found a legitimate explanation for the anomaly. The suspicious appearance of a pattern is not sufficient to validate malicious activity.

Question 5

A manager asks why an analyst is using a live stream rather than creating an analytics rule immediately. Which explanation is best?

• A. A live stream can observe query results as events arrive during an analyst-led investigation
• B. A live stream automatically creates and closes incidents
• C. A live stream permanently replaces all analytics rules
• D. A live stream validates every matching event as malicious

Correct answer: A. A live stream can observe query results as events arrive during an analyst-led investigation.

Live streams support near-real-time observation while the analyst investigates. They do not automatically establish maliciousness or replace formal detection rules.