PastePile

Evidence formats

Microsoft Defender for Endpoint export analysis

Take the device events you already pulled in Defender advanced hunting, save them as CSV (the portal's Export gives an Excel workbook; save that as CSV UTF-8) or JSON, and drop the file into a case. PastePile maps each record by its ActionType, adds it to the same timeline as your other evidence, and runs the Windows compromise pack. Hunts come back as Defender KQL you can paste straight into advanced hunting, alongside Sentinel KQL, Splunk SPL, Elastic ES|QL and Sigma.

On this page

What you can upload

  • Defender for Endpoint advanced hunting results saved as CSV. The portal's Export button saves an Excel workbook, which PastePile does not open: save it as CSV first
  • The same results as JSON, including fields Defender nests as JSON inside a column

How to export it

  1. In the Defender portal open Hunting, then Advanced hunting.
  2. Query the device and time window you care about, for example DeviceProcessEvents, DeviceNetworkEvents or EmailEvents. A query returns at most 100,000 rows; narrow the window if you reach it.
  3. Select Export. For a table this saves an Excel workbook, which PastePile does not open: open it in Excel and save it as CSV UTF-8, keeping the header row.
  4. Times are shown in UTC unless someone changed the portal's time zone (System, Settings, Microsoft Defender portal). If it was changed, set it back to UTC before exporting.

Access you need: Microsoft documents Security Reader or Global Reader, or the matching Defender XDR permissions, as enough to run advanced hunting.

Checked against Microsoft's documentation on 23 September 2026: Work with advanced hunting query results; Advanced hunting overview: access, limits, time zone; Microsoft Defender XDR FAQ: time zone setting.

What PastePile checks

  • The Windows compromise checks, applied to the process, registry and network events in the export
  • Entities pulled out of the export: hosts, accounts, processes, addresses and domains
  • Correlation with EVTX, Sysmon and sign-in evidence in the same case

Every finding cites the records behind it and states what it does not establish. Statistical signals are reported as rarity within your upload and never become findings. ATT&CK mappings describe what a behavior resembles, not proof that an adversary was present.

What it does not do

  • A complete Defender XDR incident bundle is not a supported import
  • Only the rows you exported are analyzed; PastePile does not query your Defender tenant

Example output

From the synthetic demo case C-0001, built from one Defender advanced hunting export (CSV):

Timestamp,DeviceName,AccountName,ActionType,FileName,InitiatingProcessFileName,ProcessCommandLine
2026-08-24T09:14:09Z,WS-4471,r.okafor,ProcessCreated,powershell.exe,WINWORD.EXE,powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand SQBFAFgA…
  • F-001 · winword.exe started powershell.exe · high
  • F-002 · PowerShell started with an encoded command · high
  • F-003 · Persistence requested from the command line (scheduled task) · high

All names, hosts and addresses are synthetic. Read the findings with their citations or the client report built from them. For the structure of a client-ready report, see the security incident report template.

Try it

Open the synthetic Office document to encoded PowerShell case to see the timeline, findings, unknowns and report without an account. When you are ready, create an account and compare plans.

Other evidence formats