Creating Custom Tracked Queries in Microsoft Defender

SC-200 By islever Editorial Last updated

Detect threats by using Microsoft Defender XDR

Short answer

A Use the Threat analytics page to create and manage custom tracked queries for assessing the threat status of the subscription.

Question

You have a Microsoft 365 subscription that uses Microsoft 365 Defender.
You plan to create a hunting query from Microsoft Defender.
You need to create a custom tracked query that will be used to assess the threat status of the subscription.
From the Microsoft 365 Defender portal, which page should you use to create the query?
  1. Threat analytics Correct Answer
  2. Advanced Hunting
  3. Explorer
  4. Policies & rules

Key Takeaways

The question tests the distinction between creating ad-hoc investigations (Advanced Hunting) and setting up persistent monitoring (Threat Analytics). The common trap is selecting Advanced Hunting, which is used for manual querying rather than automated or saved tracking.

To create a custom tracked query for assessing threat status in Microsoft 365 Defender, you must use the Threat analytics page. This feature allows administrators to save and monitor specific queries as trackers.

Common mistake: Most candidates select B (Advanced Hunting) because it is the primary tool for writing Kusto Query Language (KQL) statements. However, Advanced Hunting is for interactive investigation, not for creating 'tracked' entities that persistently assess threat status.

Expert Analysis

Why the Answer Is Correct

The correct answer is A. In Microsoft 365 Defender, Threat analytics is the hub for managing threat trackers. A threat tracker is defined as a saved query that automatically or manually monitors cybersecurity threats in your organization. By navigating to the Threat analytics page, you can create a custom tracked query that runs periodically to assess the current threat status of your subscription based on the logic defined in the query.

Why the Other Options Are Wrong

Option B, Advanced Hunting, is the correct place to write the underlying KQL logic, but it is not the interface for creating and managing 'tracked' queries. Advanced Hunting is an investigative workspace. Option C, Explorer, is typically used for reviewing alerts and incidents, not for defining new tracking logic. Option D, Policies & rules, manages configuration settings like alert thresholds and response automation rules, not the queries themselves.

Community Comment Notes

While the majority of voters selected B, citing general hunting capabilities, this overlooks the specific terminology of 'tracked query.' User Solopraiz707 correctly identified A, noting that "A custom tracked query... is created from the Threat analytics area." The official documentation confirms that threat trackers are managed within the Threat analytics section to provide ongoing assessment.

Official Reference

https://learn.microsoft.com/en-us/defender-office-365/threat-trackers

This link opens the official vendor documentation in a new tab.

Exam Strategy

Focus on the specific verbs and nouns in the question. 'Create a custom tracked query' implies persistence and monitoring, which points directly to Threat Analytics. If the question asked 'Where do you write a KQL query to investigate a specific event?', then Advanced Hunting would be correct.

Frequently Asked Questions

What is the difference between Advanced Hunting and Threat Analytics?

Advanced Hunting is for manual, ad-hoc investigation using KQL. Threat Analytics is for saving and automating those queries as 'trackers' to continuously monitor for threats.

Can I run a custom query without creating a tracker?

Yes, you can run any KQL query in Advanced Hunting. However, only by saving it as a tracker in Threat Analytics does it become a persistent assessment tool for the subscription's status.

More SC-200 FAQ →

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. yoton 👍 12
    https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-overview?view=o365-worldwide "Use Advance mode if you're comfortable creating custom queries." Answer is B
  2. ACSC 👍 5 Answered B
    https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-modes?view=o365-worldwide#get-started-with-guided-hunting-mode
  3. Nikki0222 👍 2
    B correct
  4. Solopraiz707 👍 1 Answered A
    A. Threat analytics - A custom tracked query used to assess the threat status of your Microsoft 365 environment is created from the Threat analytics area of the Microsoft Defender portal. Threat trackers are saved queries used to automatically or manually monitor cybersecurity threats in the organization https://learn.microsoft.com/en-us/defender-office-365/threat-trackers
  5. Baz10 👍 1 Answered B
    Lol its not a trick question dw
Show 1 more comment
  1. chepeerick 👍 1
    the option B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Least-privilege roles for Microsoft 365 Defender action approvals

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide