---
name: Threat Hunting Readiness Baseline
description: "Assess whether the tenant is ready for threat hunting: log retention, advanced hunting access, Sentinel workspace coverage and KQL availability."
---

# Threat Hunting Readiness Baseline

> **TL;DR:** This read-only skill checks whether the tenant is ready for proactive threat hunting by reviewing log retention, advanced hunting access, Microsoft Sentinel workspace coverage and KQL availability, then returns a simple readiness score.

## Is your Microsoft 365 tenant ready for proactive threat hunting?

Effective threat hunting depends on having enough telemetry, the right access and a place to run queries. This skill reviews Microsoft Defender XDR advanced hunting (which retains up to 30 days of raw events across Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps and Microsoft Defender for Identity) alongside any connected Microsoft Sentinel workspace. It confirms that log retention, role assignments and Kusto Query Language (KQL) hunting are all in place so hunters can pivot across Exchange Online, Microsoft Teams and identity signals. Nothing is changed; the skill only reads and reports.

## When should you run this skill?

- "Are we actually ready to start threat hunting in this tenant?"
- "Check whether advanced hunting and KQL are available to our analysts."
- "How long is our security telemetry retained for hunting?"
- "Do we have a Microsoft Sentinel workspace and is it covering our workloads?"
- "Confirm our hunting team has the right read-only roles before the uplift project."
- "Give me a readiness baseline for proactive threat hunting."
- "What gaps would stop us hunting across identity, email and endpoint data?"

## How this skill works, step by step

1. Confirm the operator holds a read-only security role and that the Microsoft Defender portal is reachable for the tenant.
2. Check that Microsoft Defender XDR advanced hunting is enabled and record the effective raw-event retention window (typically up to 30 days).
3. Enumerate which Defender data tables are populated (endpoint, email, cloud app and identity) to confirm telemetry breadth.
4. Detect whether a Microsoft Sentinel workspace is connected and list which workloads are streaming data into it for longer-term retention.
5. Read the workspace data-retention setting and any connected data connectors to measure hunting coverage beyond the 30-day Defender window.
6. Verify that KQL advanced hunting and Sentinel hunting queries are available, and check for saved or custom hunting queries already in place.
7. Review least-privilege role assignments to confirm hunters have read-only access without standing write or response permissions.
8. Score each dimension (retention, table coverage, Sentinel coverage, access and KQL availability) as met, partial or gap, weighting longer retention and broader coverage more heavily.
9. Derive an overall readiness score (0 to 100, higher is more ready) and compile the results into a single read-only summary table and bullet list.

## Output format

The skill returns a readiness table followed by a short summary. Each row is one readiness dimension mapped to a status and a contribution to the overall score.

| Dimension | Finding | Status | Score contribution |
| --- | --- | --- | --- |
| Defender advanced hunting | Enabled, 30-day raw event retention across all four Defender tables | Met | 25 / 25 |
| Sentinel workspace coverage | Workspace connected, 90-day retention, sign-in and audit connectors active | Partial | 14 / 25 |

Summary of the run:

- Overall readiness score and band (for example, 78 / 100, "mostly ready").
- The strongest dimension and the weakest dimension found.
- Whether a Microsoft Sentinel workspace is connected and its retention period.
- A recommendation to close any dimension scored as a gap before relying on hunting.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Advanced hunting in Microsoft Defender XDR | Microsoft 365 E5, Microsoft 365 E5 Security, or Microsoft Defender for Endpoint Plan 2 |
| Identity and sign-in telemetry | Microsoft Entra ID P1 (P2 for full risk detail) |
| Microsoft Sentinel hunting and long-term retention | Microsoft Sentinel (Azure subscription, pay-as-you-go) |

### Least-privilege roles

- Security Reader (Microsoft Entra directory role) for read-only access to the Defender portal and advanced hunting.
- Microsoft Sentinel Reader (Azure RBAC) for read-only access to the Sentinel workspace, hunting queries and retention settings.

### Microsoft Graph permissions (read-only)

This skill is operated through the Microsoft Defender portal and the Azure portal for Microsoft Sentinel, not through directory write operations. The following read-only scopes apply when querying via Microsoft Graph:

- `ThreatHunting.Read.All` - confirms advanced hunting KQL availability and reads Defender XDR hunting tables.
- `SecurityEvents.Read.All` - reads related security alerts and events for telemetry coverage context.

Sentinel workspace retention and connector status are read via the Azure portal or Azure Resource Manager using the Microsoft Sentinel Reader role, not Microsoft Graph.

## Scope and safety

This skill is read-only by default. It inspects retention settings, role assignments, table coverage and workspace configuration, then summarises readiness; it never changes any tenant or workspace setting.

This skill does NOT:

- Enable, disable or reconfigure advanced hunting, connectors or retention.
- Create, modify or run custom detection or analytics rules.
- Assign, change or remove any role or permission.
- Take any response, investigation or remediation action.

## Sources and compliance

- [Advanced hunting overview (Microsoft Defender XDR)](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview)
- [Hunt for threats with Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/hunting)
- Maps to Essential Eight by supporting the event logging and monitoring foundations that underpin the regular backups and multi-factor authentication detection objectives. See the [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model).
- Aligns with ISM event logging, monitoring and detection guidance for retaining and analysing security-relevant events.
- Output in Australian English.