Use shared queries in advanced hunting

Advanced hunting queries can be shared with users in your organization. You can also save queries that only you can access. Community queries on GitHub are available too. With saved queries, you can quickly start hunting for threats. You don't need to write queries from scratch.

The Queries tab in advanced hunting lists Shared queries, My queries, and Community queries. Select an arrow to expand a group.

Save, modify, and share a query

You can save a new or existing query so that it is only accessible to you or shared with other users in your organization.

1. Create or modify a query.

2. Click the Save query drop-down button and select Save as.

3. Enter a name for the query.

   

4. Select the folder where you'd like to save the query.

   • Shared queries — shared to all users your organization
   • My queries — accessible only to you

5. Select Save.

Delete or rename a query

You can rename or delete a saved query at any time.

1. Find the query. Select the three dots next to it.

   

2. To remove the query, select Delete and confirm. To change its name, select Rename and enter a new name.

Create a direct link to a query

To generate a link that opens your query directly in the advanced hunting query editor, finalize your query and select Share link.

Access community queries in the GitHub repo

Microsoft security researchers share hunting queries in a public GitHub repository. All queries are reviewed before they're published. To contribute, join GitHub for free.

You can also find these queries in the Community queries list.

Community queries are grouped into folders such as Campaigns, Collection, and Defense evasion. Each query includes in-line comments with more details.

Related content

• Advanced hunting overview
• Learn the query language
• Work with query results
• Hunt across devices, emails, apps, and identities
• Understand the schema
• Understand the schema
• Apply query best practices