Hunting capabilities are operationalized in Microsoft Sentinel via saved hunting queries or bookmarks

Overview

Hunting in Sentinel is the proactive, hypothesis-driven counterpart to rule-based detection: SOC analysts run KQL queries against ingested telemetry to find threat actor behavior that no analytics rule has yet been written to catch — emerging TTPs, novel persistence mechanisms, low-and-slow command-and-control, insider data staging, supply chain compromise, and post-compromise reconnaissance. Sentinel exposes hunting through three documented surfaces: saved hunting queries (Microsoft.SecurityInsights/huntingQueries legacy resource and the modern hunts API, Microsoft.SecurityInsights/hunts), bookmarks that pin investigation findings (Microsoft.SecurityInsights/bookmarks) for case-tracking and incident attachment, and Notebooks (Jupyter / Azure ML) for advanced investigation workflows. Without operationalized hunting, the SOC operates in a purely reactive posture and only finds what its current rule corpus is configured to find; investigations cannot be tracked or shared across analysts, and the institutional knowledge of “we have hunted this hypothesis and ruled it out” or “we have found this anomaly and need to keep investigating” is lost when the analyst’s browser tab closes. The check confirms at least one saved hunting query or bookmark exists in the workspace, indicating hunting is being practiced rather than aspirational.

Remediation

• Hunt for threats with Microsoft Sentinel
• Use bookmarks to save interesting information while hunting
• Use Jupyter Notebook to hunt for security threats

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Medium
Impact on users	Low
Pillar	SecOps
Category	Security information and event management
Product	Azure
Feature	Microsoft Sentinel
Area	Logging and detection
Licence	Consumption-based: Microsoft Sentinel
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.