Work with advanced hunting query results

While you can construct your advanced hunting queries to return precise information, you can also work with the query results to gain further insight and investigate specific activities and indicators. You can take the following actions on your query results:

• View results as a table or chart
• Export tables and charts
• Drill down to detailed entity information
• Tweak your queries directly from the results
• View query execution details and troubleshoot errors
• View timeline of events

View query results as a table or chart

By default, advanced hunting displays query results as tabular data. You can also display the same data as a chart. Advanced hunting supports the following views:

Construct queries for effective charts

When rendering charts, advanced hunting automatically identifies columns of interest and the numeric values to aggregate. To get meaningful charts, construct your queries to return the specific values you want to see visualized. Here are some sample queries and the resulting charts.

Alerts by severity

Use the summarize operator to get a numeric count of the values you want to chart. The following query uses the summarize operator to count the number of alerts by severity.

AlertInfo
| summarize Total = count() by Severity

When rendering the results, a column chart displays each severity value as a separate column:

AlertInfo
| summarize Total = count() by Severity
| render columnchart

Phishing emails across top ten sender domains

If you're dealing with a list of values that isn't finite, use the Top operator to chart only the values with the most instances. For example, to get the top 10 sender domains with the most phishing emails, use the following query:

EmailEvents
| where ThreatTypes has "Phish"
| summarize Count = count() by SenderFromDomain
| top 10 by Count

Use the pie chart view to effectively show distribution across the top domains:

File activities over time

By using the summarize operator with the bin() function, you can check for events involving a particular indicator over time. The following query counts events involving the file invoice.doc at 30-minute intervals to show spikes in activity related to that file:

CloudAppEvents
| union DeviceFileEvents
| where FileName == "invoice.doc"
| summarize FileCount = count() by bin(Timestamp, 30m)

The following line chart clearly highlights time periods with more activity involving invoice.doc:

Export tables and charts

After running a query, select Export to save the results to a local file. Your chosen view determines how the results are exported:

• Table view—The query results are exported in tabular form as a Microsoft Excel workbook.
• Any chart—The query results are exported as a JPEG image of the rendered chart.

Filter results

After running a query, select Filter to narrow down the results.

To add a filter, select the data you want to filter for by selecting one or more of the check boxes. Then select Add.

You can narrow the results down even further to specific data by selecting the newly added filter.

This selection opens a dropdown showing the possible filters you can use. Select one or more of the check boxes, and then select Apply.

Confirm that you added the filters you want by checking the Filters section.

Drill down from query results

You can explore the results in-line by using the following features:

• Expand a result by selecting the dropdown arrow at the left of each result.
• Where applicable, expand details for results that are in JSON and array formats by selecting the dropdown arrow at the left of applicable column names for added readability.
• Open the side pane to see a record's details (concurrent with expanded rows).

You can also right-click on any result value in a row so that you can use it to add more filters to the existing query or copy the value for use in further investigation.

For JSON and array fields, you can right-click and update the existing query to include or exclude the field, or to extend the field to a new column.

To quickly inspect a record in your query results, select the corresponding row to open the Inspect record panel. The panel provides the following information based on the selected record:

• Assets—Summarized view of the main assets (mailboxes, devices, and users) found in the record, enriched with available information, such as risk and exposure levels.
• All details—All the values from the columns in the record.

To view more information about a specific entity in your query results, such as a machine, file, user, IP address, or URL, select the entity identifier to open a detailed profile page for that entity.

Tweak your queries from the results

Select the three dots to the right of any column in the Inspect record panel. Use the options to:

• Explicitly look for the selected value (==)
• Exclude the selected value from the query (!=)
• Get more advanced operators for adding the value to your query, such as contains, starts with, and ends with

View query execution details and troubleshoot errors

View a query's execution details to understand why the query behaved the way it did, whether it succeeds or fails. This feature provides more visibility into query execution and helps you troubleshoot any problems more efficiently.

After running a query, select Query Details above the query results to open a side panel:

In the Query Details side panel, select the Overview, Raw Statistics, and Errors tabs to explore your query's execution time breakdown, data source and scope, resource utilization, and other details:

If your query fails, select View full query details at the bottom of the error message to open the Query Details side panel. The error message might also provide an explanation why the query failed and actionable suggestions to fix it.

Add items to Favorites

Add your frequently used schemas, functions, queries, and detection rules to the Favorites section of each tab in the advanced hunting page for quick access.

For example, to add AlertInfo to your Favorites, go to the Schema tab, select the three dots to the right of the table, and select Add to favorites.

A notification appears to inform you that the item was successfully added to Favorites.

You can do the same for your saved functions, queries, and custom detections in their respective Favorites sections right under each tab (Functions, Queries, and Detection Rules).

Automatic timeline rendering

By default, a timeline appears above the advanced hunting results that displays event counts over time. The timeline automatically renders based on the Timestamp or timeGenerated column in the query results. It automatically updates when you apply filters and can help you quickly identify abnormal behavior and trends and focus on interesting results.

You can select whether to display the timeline by default in the Chart preferences settings.

The timeline automatically adjusts its resolution based on the range of results.

Filter the timeline results

Select any point on the timeline to filter both the results and the timeline to that specific time range. The timeline also updates its scale to match the selected time period. When you filter by a specific range, it zooms in to show event distribution in high resolution.

Split the timeline by values

You can split the results in the timeline by any column that has at least two but fewer than 50 unique values.

Change chart type

You can change the chart type of the timeline by selecting a different option from the chart type dropdown menu. The available chart types include:

• Line chart
• Column chart
• Pie chart

Rendering conditions

The timeline appears only if your results meet the following conditions:

• Your results include more than 40 events.
• Your results include a Timestamp or timeGenerated column.

Related topics

• Advanced hunting overview
• Learn the query language
• Use shared queries
• Hunt across devices, emails, apps, and identities
• Understand the schema
• Apply query best practices
• Custom detections overview