Microsoft Defender XDR Pivot Map

Threat Hunting and Incident Response
Reference Tools for Microsoft XDR

Interactive tools for security analysts — pivot maps, schema references,
and investigation playbooks for Microsoft Defender XDR.

XDR Advanced Hunting Pivot Map

Force-directed graph of Defender XDR table relationships. Hunt by scenario — phishing, lateral movement, credential access, and more.

45 tables · 12 use cases · D3 force graph

Tables for Muggles

Plain-English guide to every Defender XDR table — where the data comes from, what it means, and the columns that matter most for IR and threat hunting.

47 tables · topic filters · key columns

MITRE ATT&CK × Defender XDR Crosswalk

Browse Enterprise tactics and techniques mapped to Defender XDR tables, key columns, and ready-to-run KQL hunting queries.

14 tactics · 40+ techniques · KQL ready

Incident Roadmaps

Ordered investigation paths for Email, Device, Identity, Malware, and IP pivots. Each stop shows what to look for, pivot columns, and KQL queries.

5 pivots · 5 scenarios · 70+ stops · KQL ready

Obsidian Canvas & Cheat Sheet Exports

Download the pivot map and investigation roadmaps as Obsidian Canvas files. Explore, annotate, and extend offline inside your vault.

6 canvas files · Obsidian ≥ 1.1 · offline ready

KQL Cheat Sheet

Quick reference for Kusto operators, time functions, joins, and type casting. JSON parsing patterns for CloudAppEvents, AlertEvidence, and more — including MailItemsAccessed expand patterns for tracking attacker email recon.

8 operator categories · 12 JSON patterns · copy-ready KQL

Last Updated: 2026-06-25

Not a Microsoft product. Not endorsed by, affiliated with, or supported by Microsoft in any way. Microsoft, Microsoft Defender, and Microsoft Defender XDR are trademarks of Microsoft Corporation.