Listen to this Post
MDEAutomator’s HuntManager is a powerful tool that automates Advanced Hunting operations in Microsoft Defender for Endpoint (MDE). It leverages .csl query files and .json output files stored in an Azure Storage Account, enabling automated daily hunts across all configured tenants.
🔗 MDEAutomator GitHub Repo: https://lnkd.in/gzHd6qKF
You Should Know: Practical Implementation & Commands
1. Setting Up MDEAutomator
Before using HuntManager, ensure you have:
- Azure Storage Account (for storing queries/results)
- Microsoft Defender for Endpoint API access
- PowerShell 7+
Installation Steps:
Clone the MDEAutomator repo git clone https://github.com/microsoft/MDEAutomator.git cd MDEAutomator Install required PowerShell modules Install-Module -Name Az -Force Install-Module -Name Microsoft.Graph -Force
2. Configuring Hunt Queries
Store your Advanced Hunting queries (.csl) in Azure Blob Storage:
Upload a query to Azure Blob Storage $storageContext = New-AzStorageContext -ConnectionString "Your_Storage_Connection_String" Set-AzStorageBlobContent -File "Query1.csl" -Container "hunt-queries" -Context $storageContext
3. Running Automated Hunts
HuntManager executes queries daily. To manually trigger:
Run a specific hunt query .\HuntManager.ps1 -QueryName "Query1.csl" -OutputFormat JSON
4. Analyzing Results
Outputs are stored in JSON format. Use jq (Linux) or ConvertFrom-Json (PowerShell) to parse:
Linux (jq)
cat output.json | jq '.Results[] | {DeviceName, FileName, ThreatName}'
PowerShell
$results = Get-Content "output.json" | ConvertFrom-Json
$results.Results | Select-Object DeviceName, FileName, ThreatName
- Automating with Cron (Linux) or Task Scheduler (Windows)
- Linux (Cron Job):
Add to crontab -e 0 3 /usr/bin/pwsh /path/to/HuntManager.ps1 -AutoRun
- Windows (Task Scheduler):
Register-ScheduledJob -Name "DailyHunt" -ScriptBlock { & "C:\MDEAutomator\HuntManager.ps1" -AutoRun } -Trigger (New-JobTrigger -Daily -At "3:00 AM")
- Linux (Cron Job):
What Undercode Say
MDEAutomator’s HuntManager is a game-changer for SecOps teams, enabling automated threat hunting at scale. By integrating with Azure Storage and MDE’s Advanced Hunting, it reduces manual effort while improving detection efficiency.
🔹 Key Benefits:
✔ Automated daily hunts across multiple tenants
✔ Centralized query & result management in Azure
✔ Seamless integration with PowerShell & Microsoft Graph
🔹 Future Enhancements:
- AI-driven query optimization
- Real-time alerting via Azure Sentinel
Expected Output:
{
"Results": [
{
"DeviceName": "Workstation01",
"FileName": "malware.exe",
"ThreatName": "Trojan:Win32/Emotet"
}
]
}
Prediction
As AI-driven security automation grows, tools like HuntManager will evolve into autonomous threat-hunting systems, reducing response times from hours to seconds. Expect tighter integration with Azure Sentinel and AI-based anomaly detection in future updates.
IT/Security Reporter URL:
Reported By: Emannon Mdeautomator – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
