Run advanced hunting queries via the Microsoft Defender for Endpoint API

Steps

1. Register an Entra ID application, grant it WindowsDefenderATP > AdvancedQuery.Read.All application permission, and obtain a client-credentials bearer token for the audience https://api.securitycenter.microsoft.com.
2. Submit a Kusto Query Language (KQL) query with POST https://api.securitycenter.microsoft.com/api/advancedqueries/run, with body {"Query": "YOUR_KQL_QUERY"} and Authorization: Bearer YOUR_TOKEN.
3. Parse the JSON response; results are returned in the Results array (up to 100,000 rows) with schema defined by the columns returned from the query — no separate schema endpoint is needed.
4. Respect API quotas: up to 45 calls per minute and 1,500 calls per hour per tenant; queries are limited to data from the last 30 days and have a maximum execution time of 200 seconds.
5. For broader table coverage (including Microsoft Sentinel and Defender XDR tables), use the Microsoft Graph security API advanced hunting endpoint at https://graph.microsoft.com/v1.0/security/runHuntingQuery instead, which is the recommended current approach.