Unanswered

Defender Advanced Hunting Query + Power Automate

(0) Share

Report

Posted on by Community Power Pla... Microsoft Employee

I am looking to use the Advanced Hunting Query Item in Power Automate to gather into and post that info into a teams channel. I am getting an error on my query and I am unsure how the query needs to be passed the Advanced Hunting Step.

Here is my current Flow ( I feel like the input and output may need to be sanitized or formatted in some way). I have tried it with the query all on the same line as well with same results. Any help is greatly appreciated as I cannot really find any examples online of using this in Power Automate.

Categories:

Building flows

I have the same question (0)

All responses (3)

Answers (0)

Sort by

CarterBurbage 6 on at

Like (0)

Report
Copy link

Link copied!

I'm following this as well. Just got off the phone after an hour with Microsoft.
It really seems that it does not like the EmailEvents table. I'm also having this issue if I do not have any dynamic content in my query.

Was this reply helpful? Yes No
Community Power Pla... Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!

Hey Carter -
I abandoned this after a day or so. I feel like I ended up finding out that it WILL NOT work with EmailEvents for some reason. I want to say it isn't a supported query with the Power Automate Defender API connector or something.

However, if you find a solution please share 🙂

Was this reply helpful? Yes No
CarterBurbage 6 on at

Like (0)

Report
Copy link

Link copied!

Hey! I know it's been a while, but what I just figured out about a month back is I can now query the email events from the API! It still doesn't work from the connector, but if you do an HTTP request directed to https://graph.microsoft.com/v1.0/security/runHuntingQuery and your query like you would have it in Advanced Hunting, it worked for me.

Was this reply helpful? Yes No