Topic 5 of 8
Microsoft Defender XDR
A real attack doesn't stay in one place: it starts with an email, jumps to a device, steals a credential, and ends in a cloud app. Defender XDR brings protection for all those points together so you can see them as a single story. This article covers the suite as a whole, its portal, and AI; each product has its own article later on.
Contents
What is XDR?
XDR (extended detection and response) extends detection and response beyond the endpoint: it collects signals from devices, identities, email, and applications, and correlates them to detect and stop complete attacks.
Microsoft Defender XDR is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications.
Pre-breach
Prevention: reduce the attack surface, block phishing and malware, fix vulnerabilities and weak configurations.
Post-breach
Detection and response: correlate alerts, see the attack's scope, and automatically contain and remediate affected assets.
Watch the names
Defender XDR protects the Microsoft 365 environment: users, devices, email, identities, and SaaS apps. Defender for Cloud is something else: it protects workloads in Azure, AWS, GCP, and on-premises (CSPM and CWPP). Both show up in the same portal, but they aren't the same thing.
The products in the suite
Each product protects one part of the environment and feeds its signals to the suite. The exam often gives a need and asks for the product that covers it.
| Product | Protects | Examples |
|---|---|---|
| Defender for Endpoint | Devices: computers, phones, servers | EDR, next-generation antivirus, attack surface reduction |
| Defender for Office 365 | Email and collaboration: Exchange, Teams, SharePoint, OneDrive | Phishing, Safe Links, Safe Attachments |
| Defender for Identity | On-premises Active Directory | Reconnaissance, compromised credentials, lateral movement |
| Defender for Cloud Apps | SaaS apps | CASB, shadow IT, OAuth app governance |
| Entra ID Protection | Cloud identities | User risk and sign-in risk |
| Defender Vulnerability Management | Vulnerabilities and configuration | Inventory, risk-based prioritization, remediation |
| Security Exposure Management | The whole attack surface | Exposure graph, attack paths, Secure Score |
| Threat intelligence | Context about threats | Threat analytics, actor profiles, indicators |
The following articles in this domain cover Defender for Office 365 and Endpoint, Defender for Cloud Apps and Defender for Identity, and vulnerability management, exposure, and threat intelligence.
Coordinated cross-product protection
The suite's value is that the products share information and act together, not each on its own.
Combined incidents queue
Alerts from every product are correlated into incidents, so the SOC sees the full attack instead of dozens of loose alerts.
Automatic cross-product response
If Defender for Endpoint detects a malicious file on a device, Defender for Office 365 can remove it from the mailboxes where it arrived as an attachment.
Self-healing
Automated investigation and response (AIR) examines the evidence and remediates affected assets without manual work.
Cross-product hunting
A single query covers raw email, device, identity, and app data from the last 30 days.
What a typical attack looks like from start to finish:
Email: A phishing email arrives with an attachment. Defender for Office 365 analyzes it and alerts.
Device: A user opened the attachment before it was blocked. Defender for Endpoint sees the suspicious process.
Identity: The attacker uses the stolen credential against on-premises AD. Defender for Identity detects the lateral movement.
Cloud: Files are mass-downloaded from a SaaS app. Defender for Cloud Apps flags it as anomalous.
Correlation: Defender XDR joins the four alerts into a single incident, with the timeline and every entity.
Automatic attack disruption
Some attacks, like ransomware or business email compromise (BEC), move in minutes. Automatic attack disruption uses high-confidence signals from the whole suite to contain the attack while it's happening, without waiting for an analyst to step in.
Isolate devices
The compromised device stops communicating with the rest
Disable accounts
The compromised identity can no longer be used
Contain IPs
Communication with the attacker's infrastructure is cut off
The goal is to limit the scope and give the SOC time to investigate. The actions are logged and can be reviewed and undone from the portal.
Incidents and alerts
| Alert | Incident | |
|---|---|---|
| What it is | A signal of suspicious activity detected by a product | A set of related alerts that tell the story of an attack |
| Scope | One event or entity | Every affected entity: users, devices, mailboxes, apps |
| How it's handled | Reviewed inside the incident | Assigned, prioritized, investigated, and closed |
In the portal, the incidents queue also includes Microsoft Sentinel incidents when it's connected, so the SOC works everything from one place.
Advanced hunting
Advanced hunting is a query tool over up to 30 days of raw data from the whole suite. It's used to proactively look for threats, indicators, and activity that didn't raise alerts.
- Queries are written in KQL (Kusto Query Language).
- A guided query builder lets you hunt without writing code.
- Security Copilot turns natural language questions into KQL queries.
- A useful query can be turned into a custom detection rule that runs periodically and raises alerts.
The Microsoft Defender portal
The portal (security.microsoft.com) brings together the suite's protection, detection, investigation, and response. Signing in requires a role such as Global Reader, Security Reader, Security Administrator, or Security Operator, and role-based access control decides which cards and data each user sees.
Investigation and response
Incidents and alerts (XDR and Sentinel), advanced hunting, custom detection rules, Action center (pending actions and history), and Submissions to Microsoft for analysis.
Threat intelligence
Threat analytics, actor profiles, and intel explorer, built into the portal.
Assets
Inventory of devices (by default, those seen in the last 30 days), identities, applications, cloud resources, and AI agents.
Exposure management
Secure Score, initiatives, vulnerability management, attack paths.
Products
Nodes for Endpoints, Email & collaboration (Office 365), Identities, Cloud apps, and Cloud security (Defender for Cloud overview).
Other
SOC optimization, reports, learning hub, partner catalog, and system settings.
Defender Experts for XDR
A managed detection and response service: Microsoft experts monitor, investigate, and respond to incidents on the organization's behalf. It isn't included with the suite: it's sold separately.
Security Copilot in Defender XDR
Security Copilot is embedded in the portal to speed up analyst work. It doesn't make decisions for them: it summarizes, explains, and recommends.
Incident summaries
Summarizes incidents with up to 100 alerts: what happened, entities, timeline.
Guided responses
Recommended triage, containment, and remediation steps, with specific guidance for phishing, BEC, and ransomware.
Script and file analysis
Explains suspicious scripts and files and whether they're malicious.
Natural language to KQL
Generates advanced hunting queries from a question.
Incident reports
Drafts a report with the incident's actions and classification.
Device and identity summaries
Posture, risk, and relevant activity for a device or user.
There are also agents that work autonomously on specific tasks:
- Phishing Triage Agent: classifies user-reported phishing emails and separates real threats from false alarms. It requires Defender for Office 365 Plan 2 and Security Copilot.
- Threat Intelligence Briefing Agent: prepares intelligence reports tailored to the organization.
- Threat Hunting Assistant: helps formulate and refine hunts.
- Dynamic Threat Detection Agent: continuously looks for threats that existing detections don't cover.
Defender XDR vs. Sentinel
| Defender XDR | Microsoft Sentinel | |
|---|---|---|
| Type | XDR | SIEM + SOAR |
| Sources | Products in the Defender suite | Any source: Microsoft, third parties, AWS, GCP, firewalls |
| Response | Native in each product, AIR, automatic disruption | Playbooks and automation rules |
| Hunting retention | 30 days | Whatever you configure, up to 12 years in the data lake |
They don't compete: they complement each other. Together, in the same portal, they form Microsoft's unified security operations platform.
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| See as a single case a phishing email that ended in an infected device and a stolen account | Defender XDR incident | It correlates alerts from several products. |
| Stop ransomware in progress without waiting for an analyst | Automatic attack disruption | It contains devices and accounts using high-confidence signals. |
| Query 30 days of email, device, and identity events with KQL | Advanced hunting | Raw data from every product. |
| Review pending and completed remediation actions | Action center | History and approval of actions. |
| Send Microsoft an email that was misclassified | Submissions | Analysis and filter improvement. |
| Have Microsoft experts investigate and respond on behalf of the SOC | Defender Experts for XDR | Managed service, sold separately. |
| Explain an obfuscated PowerShell script from an alert | Script analysis (Security Copilot) | It describes what it does and whether it's malicious. |
| Unify device alerts with logs from third-party firewalls | Sentinel + Defender XDR | XDR covers the suite; the SIEM covers any source. |
Common exam traps
❓ Are Defender XDR and Defender for Cloud the same product?
No. XDR protects the Microsoft 365 environment (users, devices, email, identities, SaaS apps); Defender for Cloud protects cloud and on-premises workloads.
❓ How many days of raw data does advanced hunting cover?
30 days. For longer retention, use Sentinel.
❓ Which language does advanced hunting use?
KQL (Kusto Query Language), the same as Sentinel.
❓ Is an incident the same as an alert?
No. An incident groups related alerts from one or more products that make up the same attack.
❓ Is Defender Experts for XDR included in E5?
No. It's a managed service sold separately.
❓ Does automatic attack disruption need an analyst's approval?
No. It acts on its own with high-confidence signals to contain the attack in progress; the SOC reviews afterward.
❓ Where do you see Sentinel and Defender XDR incidents?
In the same incidents queue in the Microsoft Defender portal.
Did you get this topic?
Test what you just learned
Defender for Endpoint detects a malicious file on a device and, automatically, that file is removed from the mailboxes where it arrived as an attachment. Which Defender XDR capability makes this possible?
Ready to test "Microsoft Defender XDR"?
Original questions, each with a full explanation.
Start a mock exam