How to Export Microsoft Defender XDR Hunting Results as JSON
Summary
A tutorial shows how to export Defender XDR Advanced Hunting results as JSONL through Microsoft Graph, with required permissions, query limits, retention caveats, and troubleshooting tips.
Key points
- Use Microsoft Graph’s runHuntingQuery endpoint with the ThreatHunting.Read.All permission and a Defender role that allows Advanced Hunting.
- The example query retrieves process-event data for a selected device and date range, then writes each result as a JSON object per line.
- Queries may time out or hit result caps; narrowing the time window or device set can help.
- Advanced Hunting retains 30 days of data; older history must come from Sentinel or another configured streaming destination.
- The article notes that Defender device names may be fully qualified, so startswith can work better than an exact match.
Article Details
- Topic
- Exporting Microsoft Defender XDR Advanced Hunting results through Microsoft Graph for review in LogTotal
Vendors
Products
Defender for EndpointYes, with Live Response in Defender for Endpoint: getfile pulls files, including exported EVTX, from a machine.LogTotalThe portal’s export button produces a spreadsheet-style file that LogTotal doesn’t read today.Microsoft GraphRun your query in Advanced hunting, then send the same query to Microsoft Graph’s runHuntingQuery to get the results as JSON.Microsoft SentinelAdvanced hunting keeps 30 days of data, so anything older has to come from Sentinel or wherever you stream Defender data.