# Defender investigation reference fragments

Find the Defender Advanced Hunting entry point, file-search fragment and SmartScreen guide. The antimalware item contains a policy link and missing image, not a complete email-investigation query.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

## Contents – MS Defender {#source-fa5c7169a24d9874}

Provides some basics on how to do a few things in Defender.

- How to unblock a website that is getting blocked by SmartScreen

[Unblock URL From Smart Screen](unblock-url-from-smart-screen.md)

- How to use some KQL to do some hunting in Defenders Advanced Hunting

## Where is Advanced Hunting {#source-972efadd859cf493}

In MS Defender

[<https://security.microsoft.com/v2/advanced-hunting>](https://security.microsoft.com/v2/advanced-hunting)

OR <https://security.microsoft.com/> Investigation and Response -\> Hunting -\> Advanced Hunting

## Find Emails Blocked By AntiMalware Policy (HasAttachment) {#source-2c17c51f31514dfd}

The Antimalware policy

Email Attachment Blocking

[<https://security.microsoft.com/antimalwarev2>](https://security.microsoft.com/antimalwarev2)

Image alternative text: web content

!!!warning Missing source images
1 image record(s) in this source have no resolved payload. Available alternative text is retained; the missing pixels have not been recreated.
!!!

## Find a File {#source-1a3fea36be7b44d5}

DeviceFileEvents

\| where FileName contains "infatica"

\| project Timestamp,ActionType,ProductName = InitiatingProcessVersionInfoProductName, ProcessDescription = InitiatingProcessVersionInfoFileDescription ,ParentFileName = InitiatingProcessParentFileName,ParentProcessCreationTime = InitiatingProcessParentCreationTime,FileName,FolderPath,InitiatingProcessAccountUpn

## Email & Collaboration - Explorer {#source-745231e74595cafa}

Explorer was previously called ThreatExplorer

You can find it here

<https://security.microsoft.com/threatexplorerv3>

OR <https://security.microsoft.com/> -\> Email & Collaboration -\> Explorer

In here you can see what URL's people clicked on across various phishing campaigns.

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)