Microsoft Security Copilot in Microsoft Defender now lets you to hunt for threats using natural language

December 2025

• (Preview) Microsoft Security Copilot in Microsoft Defender now lets you to hunt for threats using natural language with the Threat Hunting Agent. This agent delivers a complete, conversational threat hunting experience by not only generates queries but also interpreting results, surfacing insights, and guiding you through full hunting sessions.
• (Preview) The following advanced hunting schema tables are now available for preview:

1. The CampaignInfo table contains contains information about email campaigns identified by Microsoft Defender for Office 365
2. The FileMaliciousContentInfo table contains information about files that were processed by Microsoft Defender for Office 365 in SharePoint Online, OneDrive, and Microsoft Teams

• (GA) The hunting graph in advanced hunting is now generally available. It also now has two new predefined threat scenarios that you can use to render your hunts as interactive graphs.
• (GA) Advanced hunting now supports custom functions that use tabular parameters. With tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries.