sysop@hub:~/cheat-sheets/defender-xdr-hunting-cheat-sheet$

defender-xdr-hunting-cheat-sheet

Paste into Advanced hunting in the Defender portal. Data goes back 30 days. pc01, evil.example and the hashes are placeholders, and every query should get a time filter that fits your case.