Microsoft Defender for Endpoint — Advanced Hunting

Author and review KQL for Microsoft Defender Advanced Hunting (M365 Defender). This skill covers Defender-native tables and operational specifics; for identity/cloud/SaaS/network telemetry use microsoft-sentinel; for vendor-neutral KQL optimisation use kusto-query-language.

1. When to use Defender vs Sentinel