topic Re: Microsoft 365 defender advance hunting query in Cortex XSOAR Discussions

Microsoft 365 defender advance hunting query

FabioFerreira — Mon, 08 May 2023 17:32:25 GMT

Hi,

I'm trying to build an advance hunting query in Microsoft 365 defender integration, but still giving me error.

!microsoft-365-defender-advanced-hunting limit=10 query="""AlertInfo | where alertId = fa85caf1c0-b9b9-bc29-f600-08db44a419b9"""

Reason Failed to execute microsoft-365-defender-advanced-hunting command. Error: Error in API call [400] - Bad Request {"error": {"code": "BadRequest", "message": "Scalar is not expected in the current context. Fix semantic errors in your query.", "target": "|2528f983-4c3b7ab3bc866db1."}}

Could you help pls

Regards,

Re: Microsoft 365 defender advance hunting query

MBeauchamp2 — Mon, 08 May 2023 19:30:07 GMT

Ass!uming you're running this manually, try using the back ticks on the query argument instead of quotes:

!microsoft-365-defender-advanced-hunting query=`AlertInfo | where alert...`

Alternatively, you can add the argument debug-mode=true to have it throw the debug of the request and see the body that is being sent etc.

Re: Microsoft 365 defender advance hunting query

FabioFerreira — Mon, 08 May 2023 21:26:25 GMT

Got it.

Thank you.

!microsoft-365-defender-advanced-hunting limit=5 query=`AlertInfo | where AlertId == 'fa85caf1c0-b9b9-bc29-0000-08db40c26d06'`

Hope it helps someone.

Regards,