Microsoft 365 defender advance hunting query

[FabioFerreira]

Hi,

I'm trying to build an advance hunting query in Microsoft 365 defender integration, but still giving me error.

!microsoft-365-defender-advanced-hunting limit=10 query="""AlertInfo | where alertId = fa85caf1c0-b9b9-bc29-f600-08db44a419b9"""

Reason
Failed to execute microsoft-365-defender-advanced-hunting command.
Error:
Error in API call [400] - Bad Request
{"error": {"code": "BadRequest", "message": "Scalar is not expected in the current context. Fix semantic errors in your query.", "target": "|2528f983-4c3b7ab3bc866db1."}}

Could you help pls

Regards,

[MBeauchamp2 · Accepted solution]

Ass!uming you're running this manually, try using the back ticks on the query argument instead of quotes:

!microsoft-365-defender-advanced-hunting query=`AlertInfo | where alert...`

Alternatively, you can add the argument debug-mode=true to have it throw the debug of the request and see the body that is being sent etc. 

[FabioFerreira]

Got it.

Thank you.

!microsoft-365-defender-advanced-hunting limit=5 query=`AlertInfo |  where AlertId == 'fa85caf1c0-b9b9-bc29-0000-08db40c26d06'`

Hope it helps someone.

Regards,