Uredi

Work with query results in guided mode

  • Odnosi se na: Microsoft Defender XDR, Microsoft Sentinel in the Microsoft Defender portal

Important

Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

This article explains how to view and work with query results in guided mode for advanced hunting, including exporting results, reviewing runtime and resource usage information, and customizing which columns appear.

In hunting using guided mode, the results of the query appear in the Results tab.

Screenshot of the Results tab showing query output in guided mode for advanced hunting

You can work on the results further by exporting them to a CSV file. Selecting Export downloads the CSV file for your use.

You can view other information in the Results view:

  • Number of records in the results list (beside the Search button)
  • Duration of the query run time
  • Resource usage of the query

View more columns

A few standard columns are included in the results for easy viewing.

To view more columns:

  1. Select Customize columns in the upper right-hand portion of the results view.

  2. In the Customize columns pane, select the columns to include in the results view and clear the columns to hide.

    Screenshot of the Customize columns picker showing available columns to control which fields appear in query results

  3. Select Apply to view results with the added columns. Use the scroll bars if necessary.

Related content

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.

  • Last updated on