Creating Custom Tracked Queries in Microsoft Defender
You have a Microsoft 365 subscription that uses Microsoft 365 Defender. You plan to create a hunting query from Microsoft Defender. You need to create a custom tracked query that will be used to assess the threat status of the subscription. From the Microsoft 365 Defender portal, which page should you use to create the query?
Community Insight
The question tests the distinction between creating ad-hoc investigations (Advanced Hunting) and setting up persistent monitoring (Threat Analytics). The common trap is selecting Advanced Hunting, which is used for manual querying rather than automated or saved tracking.
To create a custom tracked query for assessing threat status in Microsoft 365 Defender, you must use the Threat analytics page. This feature allows administrators to save and monitor specific queries as trackers.
Most candidates select B (Advanced Hunting) because it is the primary tool for writing Kusto Query Language (KQL) statements. However, Advanced Hunting is for interactive investigation, not for creating 'tracked' entities that persistently assess threat status.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is A. In Microsoft 365 Defender, Threat analytics is the hub for managing threat trackers. A threat tracker is defined as a saved query that automatically or manually monitors cybersecurity threats in your organization. By navigating to the Threat analytics page, you can create a custom tracked query that runs periodically to assess the current threat status of your subscription based on the logic defined in the query.Why the Other Options Are Wrong
Option B, Advanced Hunting, is the correct place to write the underlying KQL logic, but it is not the interface for creating and managing 'tracked' queries. Advanced Hunting is an investigative workspace. Option C, Explorer, is typically used for reviewing alerts and incidents, not for defining new tracking logic. Option D, Policies & rules, manages configuration settings like alert thresholds and response automation rules, not the queries themselves.Community Comment Notes
While the majority of voters selected B, citing general hunting capabilities, this overlooks the specific terminology of 'tracked query.' User Solopraiz707 correctly identified A, noting that "A custom tracked query... is created from the Threat analytics area." The official documentation confirms that threat trackers are managed within the Threat analytics section to provide ongoing assessment.Official Reference
Exam Strategy
Focus on the specific verbs and nouns in the question. 'Create a custom tracked query' implies persistence and monitoring, which points directly to Threat Analytics. If the question asked 'Where do you write a KQL query to investigate a specific event?', then Advanced Hunting would be correct.
Frequently Asked Questions
What is the difference between Advanced Hunting and Threat Analytics?
Advanced Hunting is for manual, ad-hoc investigation using KQL. Threat Analytics is for saving and automating those queries as 'trackers' to continuously monitor for threats.
Can I run a custom query without creating a tracker?
Yes, you can run any KQL query in Advanced Hunting. However, only by saving it as a tracker in Threat Analytics does it become a persistent assessment tool for the subscription's status.
Related Analysis
Practice All SC-200 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-200 Practice Test →