Map hunting-result identifiers before using the preview graph view

Source facts

Microsoft Defender’s advanced-hunting graph visualization is in preview. It maps query-result columns to nodes and relationships without requiring a graph-specific query. The command is unavailable above two thousand result rows, and the rendered graph is limited to four thousand nodes. Microsoft Learn.

Enriched entity panes require a supported node type and the expected identifier. Microsoft gives DeviceId for machines and SHA1 or SHA256 for files as examples. Unsupported type names become generic nodes. A generic pane therefore calls for checking the mapping, not assuming the entity is absent from Defender. Microsoft Learn.

Applicability

Use this procedure for Microsoft Defender advanced-hunting graph visualization in preview. Keep the returned rows, chosen identifiers and graph mapping available together; the graph is a view of that selected result set.

DSE recommendation

DSE recommends beginning with a narrow query that projects the identifiers needed for the investigation. Name node types deliberately and retain useful human-readable labels as additional properties rather than replacing the identifiers. If the graph becomes too large, narrow the investigative question or mapping and record what was excluded. Do not mistake a smaller visualization for a complete account of the incident.

Verification

Select representative nodes and confirm they open the expected entity panes. Trace one relationship back to its underlying events and compare the identifiers with the original rows. Correct generic nodes that should be enriched, then reapply the mapping. Preserve the query and mapping alongside any exported picture so another analyst can reproduce the interpretation.

Official references

Microsoft Learn: Work with advanced hunting query results.