Microsoft Defender XDR

Microsoft Defender XDR is the unified extended detection and response platform that correlates signals from 9 security products into a single incident pipeline:

• MDE (Defender for Endpoint). endpoint protection, EDR, ASR rules, automated investigation
• MDO (Defender for Office 365). email and collaboration security, anti-phishing, Safe Links/Attachments
• MDI (Defender for Identity). Active Directory threat detection, lateral movement, posture assessments
• MDA (Defender for Cloud Apps). CASB, shadow IT discovery, OAuth app governance, session controls
• MDC (Defender for Cloud). cloud workload protection, CSPM, multi-cloud security
• DVM (Vulnerability Management). risk-based vulnerability assessment, security baselines
• Entra ID Protection. identity risk detection, risky sign-ins, leaked credentials
• App Governance. OAuth app monitoring, supply chain threat detection
• DLP signals. data loss prevention alerts correlated with other threat signals

All products converge in the unified portal at security.microsoft.com where alerts from any product are automatically correlated into unified incidents.

Defender XDR overview

Defender XDR licensing depends on which products you need:

• Microsoft 365 E5: Includes all Defender products (MDE P2, MDO P2, MDI, MDA, Entra ID P2, App Governance, DLP, Purview). This is the most comprehensive option.
• Microsoft 365 E5 Security: Add-on to E3 that includes MDE P2, MDO P2, MDI, MDA, and Entra ID P2
• Individual plans: MDE P1 (included in E3), MDE P2, MDO P1, MDO P2, MDI, and MDA can each be licensed separately
• Defender for Cloud: Licensed per Azure subscription with per-resource pricing (separate from M365 licensing)

The unified Defender XDR portal is available to all customers with any Defender product. The cross-product correlation, advanced hunting, and unified incidents work automatically once products are configured.

Licensing prerequisites

Automated Investigation and Response (AIR) is Defender XDR's built-in automation engine that analyses alerts and takes remediation actions:

1. Trigger: An alert fires (e.g., malicious file detected, compromised credentials, phishing email delivered)
2. Investigation: AIR automatically expands the investigation by analysing related entities: processes, files, network connections, users, mailbox rules, and sign-in activity
3. Verdict: Each entity is classified as Malicious, Suspicious, or Clean with evidence collected
4. Remediation: Based on findings, AIR recommends or executes actions: quarantine files, isolate devices, disable accounts, delete emails, or block URLs
5. Approval: Actions can be set to automatic (execute immediately) or semi-automatic (require SOC analyst approval before executing)

AIR dramatically reduces Mean Time to Respond (MTTR). For well-tuned environments, 70-80% of incidents can be auto-remediated without analyst intervention.

Automated investigation

Advanced hunting is a KQL-based query tool that provides access to 30+ raw data tables across all Defender products, enabling proactive threat hunting and custom detections:

• Endpoint tables: DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents, DeviceLogonEvents, DeviceRegistryEvents
• Email tables: EmailEvents, EmailAttachmentInfo, EmailUrlInfo, EmailPostDeliveryEvents
• Identity tables: IdentityLogonEvents, IdentityQueryEvents, IdentityDirectoryEvents
• Cloud app tables: CloudAppEvents (SaaS application activities)
• Alert/incident tables: AlertInfo, AlertEvidence, IncidentInfo
• Vulnerability tables: DeviceTvmSoftwareVulnerabilities, DeviceTvmSecureConfigurationAssessment

You can join tables across products to trace multi-stage attacks: a phishing email (EmailEvents) leading to a credential compromise (IdentityLogonEvents) followed by lateral movement (DeviceLogonEvents) and data exfiltration (DeviceFileEvents).

Advanced hunting queries can be saved as Custom Detection Rules that run automatically on a schedule and generate alerts with response actions.

Advanced hunting overview

Defender XDR uses graph-based correlation to automatically link related alerts from different products into a single unified incident:

• Entity linking: Alerts sharing the same entities. user accounts, devices, IP addresses, file hashes, mailboxes. are grouped together
• Time proximity: Alerts occurring within a related timeframe are correlated to capture the full attack timeline
• Attack pattern matching: Known attack patterns (e.g., phishing → credential theft → mailbox rule → lateral movement) trigger proactive correlation even before all stages are detected
• Continuous enrichment: As new alerts fire, they are automatically added to existing incidents if entity overlap is detected

Example: A phishing email detected by MDO and a suspicious sign-in detected by Entra ID Protection for the same user are merged into a single "Compromised User" incident, even though they come from different products.

This eliminates alert fatigue: instead of 50 separate alerts across 5 products, analysts see 1 unified incident with a correlated attack story showing the full kill chain.

Incidents overview