Question

A security analyst at Contoso wrote a KQL query in Microsoft Defender XDR advanced hunting that identifies devices where a suspicious PowerShell command downloads content from a known-bad domain. The query returns accurate results when run manually. The analyst wants Defender XDR to automatically run this query on a recurring schedule and generate an alert (and optionally take response actions) whenever the pattern is detected. What should the analyst do?

Accepted Answer

Create a custom detection rule from the query, setting the run frequency and specifying impacted entities and response actions.

Answer

Save the query to the query store and add it to a favorites folder so other analysts can run it.

Answer

Create a new alert policy in the Microsoft Purview portal referencing the KQL query.

Answer

Export the query results to CSV and configure a Power Automate flow to email the SOC when new rows appear.