More Defender Hunting Tables, and a Future-Proof Transport ​

June 2, 2026 · InfraScout Team

When we brought Defender Advanced Hunting into chat, we started with the most common security pivot — device process events — plus alert evidence and a generic KQL passthrough. This update fills out the device-event surface with four more typed tools and quietly moves the whole feature onto Microsoft's current hunting query API so it keeps working well past Microsoft's retirement of the older endpoint in early 2027. Both changes are live now, and the second one needs nothing from you.

Four more tables, typed for the pivot ​

Process events tell you what ran. A real investigation rarely stops there — you follow a process to the files it touched, the connections it opened, the registry keys it changed, and the libraries it loaded. Each of those is its own Defender table, and each now has a dedicated tool you can call mid-assessment without hand-writing KQL.

  • Device file events — pivot on file activity by name or hash. Ask whether a known-bad SHA-256 ever landed on your fleet, or trace which devices wrote, renamed, or deleted a specific file during an incident window.
  • Device network events — follow connections by remote IP, URL, port, or protocol. Confirm whether anything reached a suspicious destination, or scope the blast radius of a command-and-control indicator across devices.
  • Device registry events — surface persistence and tampering. Filter on registry-key path fragments and the kind of change made, so you can spot autorun keys, service modifications, or security-setting edits.
  • Device image-load events — catch suspicious DLLs and modules by file name or load path. This is where living-off-the-land and side-loading patterns show up, and it pairs naturally with the process-events tool to reconstruct what a process pulled in.

Like the process-events tool, each one accepts only the filters it is built for, plus the common device, time-range, and result-limit arguments you already know. They are read-only and return results in the same consistent envelope — column metadata, rows, total count, and a truncation flag — so an AI client can chain them into a single line of inquiry: find the file, follow its network connections, check what it loaded, and write the finding back to the run.

For anything the typed tools don't wrap — joins across tables, summarize, or signed-versus-unsigned image hunting that spans certificate data — the generic KQL tool is still there to take your query as-is.

A transport migration you won't notice ​

Microsoft is retiring the older Defender XDR Advanced Hunting APIs; they stop returning data on February 1, 2027. Anything still pointed at those endpoints simply goes quiet after that date.

InfraScout's Advanced Hunting tools now run on Microsoft's current hunting query API instead. This is purely a change in how InfraScout talks to Microsoft behind the scenes — the same KQL you write, the same tool arguments, and the same results. We made the switch now, well ahead of the deadline, so the feature carries straight through the retirement with no interruption.

There is nothing for you to change. Existing playbooks, saved queries, and assessment habits all keep working exactly as before.

Try it ​

Open an assessment and follow a thread end to end: "did any device load an unsigned DLL from a temp folder in the last hour?", "which machines connected to this IP today?", or "show me registry autorun changes on this device this week." InfraScout picks the right Defender table, runs it against your tenant, and hands back rows you can act on.

Questions or feedback? Reach us at info@infrascout.cloud.