Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Use a search job when you start an investigation to scan through up to a year of data in a table for specific events. You can a run search job on any table, including tables with the Analytics, Basic, and Auxiliary log plans. The search job sends its results to a new Analytics table in the same workspace as the source data.
This article explains how to run a search job in Microsoft Sentinel and how to work with the search job results.
Search jobs across certain data sets might incur extra charges. For more information, see Microsoft Sentinel pricing page.
Important
Microsoft Sentinel is generally available in the Microsoft Defender portal, including for customers without Microsoft Defender XDR or an E5 license.
Starting in July 2026, Microsoft Sentinel will be supported in the Defender portal only, and any remaining customers using the Azure portal will be automatically redirected.
We recommend that any customers using Microsoft Sentinel in Azure start planning the transition to the Defender portal for the full unified security operations experience offered by Microsoft Defender. For more information, see Planning your move to Microsoft Defender portal for all Microsoft Sentinel customers.
Start a search job
Go to Search in Microsoft Sentinel from the Azure portal or the Microsoft Defender portal to enter your search criteria. Depending on the size of the target dataset, search times vary. While most search jobs take a few minutes to complete, searches across massive data sets that run up to 24 hours are also supported.
For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Search. For Microsoft Sentinel in the Azure portal, under General, select Search.
Select the Table menu and choose a table for your search.
In the Search box, enter a search term.
Select the Start to open the advanced Kusto Query Language (KQL) editor and preview of the results for a set time range.
Change the KQL query as needed and select Run to get an updated preview of the search results.
When you're satisfied with the query and the search results preview, select the ellipses ... and toggle Search job mode on.
Specify the search job date range using the Time range selector. If your query also specifies a time range, Microsoft Sentinel runs the search job on the union of the time ranges.
Resolve any KQL issues indicated by a squiggly red line in the editor.
When you're ready to start the search job, select Search job.
Enter a new table name to store the search job results.
Select Run a search job.
Wait for the notification Search job is done to view the results.
View search job results
View the status and results of your search job by going to the Saved Searches tab.
In Microsoft Sentinel, select Search > Saved Searches.
On the search card, select View search results.
By default, you see all the results that match your original search criteria.
To refine the list of results returned from the search table, select Add filter.
As you're reviewing your search job results, select Add bookmark, or select the bookmark icon to preserve a row. Adding a bookmark allows you to tag events, add notes, and attach these events to an incident for later reference.
Select the Columns button and select the checkbox next to columns you'd like to add to the results view.
Add the Bookmarked filter to only show preserved entries.
Select View all bookmarks to go the Hunting page where you can add a bookmark to an existing incident.
Next steps
To learn more, see the following articles.