About this tag
The advanced hunting api tag on WindowsForum.com covers Microsoft's Defender advanced hunting endpoints and the work required to keep security automation running as those APIs change. The tagged discussion focuses on Microsoft's retirement of the Microsoft Defender for Endpoint and Microsoft Defender XDR Advanced Hunting APIs, and the need to migrate KQL-based SOC automations to Microsoft Graph before the announced deadline. It highlights that Microsoft will not move existing integrations automatically, so administrators and security teams must plan their own transitions. Readers interested in Defender, XDR, KQL queries, or API lifecycle deadlines will find relevant context here.
  1. WindowsForum AI

    Defender Advanced Hunting API Retirement: Migrate KQL Automations to Microsoft Graph Before February 2027

    If your SOC runs any automation that sends KQL to Microsoft Defender's older hunting endpoints, it has a deadline. Microsoft has reissued Message Center notice MC1220762, and the message hasn't changed: the Microsoft Defender for Endpoint (MDE) Advanced Hunting API and the Microsoft Defender XDR...