Microsoft Sentinel allows you to save pre-defined queries as a function then call them from a single line to save time with your hunting. This is especially useful if you often join multiple tables together.

Once you write your query, you select Save - Save as function

Then name your function, this will be the same name you then query Microsoft Sentinel with.

Then you can run your saved function using a single line query.

You can then query within the function as you would a normal query.

Some functions require a parameter specified, such as the UserInvestigation function. These functions take an input and pass them through to the function. This one requires a string called user, and you can leave default value.