Use custom functions

Applies to:

• Microsoft Defender XDR

Types of functions

A function is a type of query in advanced hunting that you can use in other queries as if it's a command. You can create your own custom functions so you can reuse any query logic when you hunt in your environment.

There are three different types of functions in advanced hunting:

• Built-in functions – Prebuilt functions included with Microsoft Defender XDR advanced hunting. These functions are available in all advanced hunting instances and can't be modified.
• Shared functions – Custom functions that users create. All users in a specific tenant can access these functions. Users can modify and control these functions.
• My functions – Custom functions that a user creates. Only the user who created these functions can view and modify them.

Write your own custom function

To create a function from the current query in the editor:

1. Select Save and then Save as function.

2. In the Save as function flyout panel, provide the following information:

   • Name - Name of the function. Can contain only numbers, English letters, and underscores. To avoid accidentally using Kusto keywords, begin or end function names with an underscore or begin with a capital letter.
   • Location - The folder in which you want to save the function, either shared or private.
   • Description - A description that helps other users understand the purpose of the function and how it works.
   • Parameters - Add a parameter for each variable in the function that requires a value when it's used. For more information, see Add parameters to your custom function.

   

3. Select Save.

Add parameters to your custom function

You can add parameters to a function so that you can provide the arguments or values for certain variables when calling the function. This feature allows the same function to be used in different queries, each with different values for the parameters.

To add parameters when saving your custom function, select Add parameter, then enter the following properties:

• Type - Data type for the value
• Name - The name that must be used in the query to replace the parameter value
• Default value - Value to use for the parameter if you don't provide a value

Parameters are listed in the order you create them, with parameters that have no default value listed before those that have a default value.

Create custom functions with tabular parameters

Create custom functions that use tabular parameters. With tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries. This capability is especially useful for complex hunting scenarios that require structured data inputs.

To create tabular parameters for your custom function:

1. Select Add parameter and then choose table as its Type.
2. Enter a Name and Default value for the table.
3. Map each column that your query references to the table. Select Add column, then enter the column's properties.

Use a custom function

Use a function in a query by typing its name along with values for any parameter, just as you would type in a command. The output of the function can either be returned as results or piped to another command.

Add a function to the current query by double-clicking on its name or selecting the three dots to the right of the function and selecting Open in query editor.

If a query requires arguments, provide them using the following syntax: function_name(parameter 1, parameter 2, ...)

Work with function codes

You can view the code of a function to understand how it works or to modify its code. Select the three dots to the right of the function and select Load function code to open a new tab with the function code.

Edit a custom function

Edit the properties of a function by selecting the three dots to the right of the function and selecting Edit details. Make any modifications that you want to the properties and parameters of the function, then select Save.

If the function code is already loaded in the editor, you can also select Save to apply any changes to the code or properties of the function.

Delete a custom function

You can delete functions from My functions and functions you created in Shared functions. You can't delete functions that you didn't create, unless you have security data manage permissions.

To delete a function, select the three dots to the right of the function and select Delete.

See also

• Advanced hunting overview
• Learn the query language
• Understand the schema
• Get more query examples