{"items":[{"children":[{"children":[{"href":"microsoft-365-defender","toc_title":"What is Microsoft Defender XDR?"},{"href":"whats-new","toc_title":"What\u0027s new"},{"href":"preview","toc_title":"preview features"},{"href":"zero-trust-with-microsoft-365-defender","toc_title":"Zero Trust"},{"href":"security-copilot-in-microsoft-365-defender","toc_title":"Microsoft Copilot in Microsoft Defender"},{"href":"usgov","toc_title":"US Government customers"},{"href":"top-scoring-industry-tests","toc_title":"Industry tests"},{"href":"microsoft-365-defender-portal","toc_title":"Microsoft Defender XDR in the Microsoft Defender portal"}],"toc_title":"Overview"},{"children":[{"href":"get-started","toc_title":"Overview"},{"href":"prerequisites","toc_title":"Prerequisites"},{"href":"data-privacy","toc_title":"Data security and privacy"},{"href":"m365d-enable","toc_title":"1. Turn on Microsoft Defender XDR"},{"href":"deploy-supported-services","toc_title":"2. Deploy supported services"},{"href":"microsoft-365-defender-train-security-staff","toc_title":"3. Train your security staff"},{"href":"deploy-configure-m365-defender","toc_title":"Setup guides for Microsoft Defender XDR"},{"children":[{"href":"pilot-deploy-overview","toc_title":"Overview"},{"href":"pilot-deploy-defender-identity","toc_title":"Defender for Identity"},{"href":"pilot-deploy-defender-office-365","toc_title":"Defender for Office 365"},{"href":"pilot-deploy-defender-endpoint","toc_title":"Defender for Endpoint"},{"href":"pilot-deploy-defender-cloud-apps","toc_title":"Defender for Cloud Apps"},{"href":"pilot-deploy-investigate-respond","toc_title":"Investigate and respond to threats"}],"toc_title":"Pilot and deploy Microsoft Defender XDR"},{"children":[{"href":"integrate-microsoft-365-defender-secops","toc_title":"Overview"},{"href":"integrate-microsoft-365-defender-secops-plan","toc_title":"Step 1. Operations readiness"},{"href":"integrate-microsoft-365-defender-secops-readiness","toc_title":"Step 2. Readiness assessment using Zero Trust"},{"href":"integrate-microsoft-365-defender-secops-services","toc_title":"Step 3. Integration with your SOC services"},{"href":"integrate-microsoft-365-defender-secops-roles","toc_title":"Step 4. Roles, responsibilities, and oversight"},{"href":"integrate-microsoft-365-defender-secops-use-cases","toc_title":"Step 5. Test use cases"},{"href":"integrate-microsoft-365-defender-secops-tasks","toc_title":"Step 6. SOC maintenance tasks"}],"toc_title":"Security operations guide"}],"toc_title":"Get started"},{"children":[{"href":"isoc-overview","toc_title":"Overview"},{"href":"defend-against-threats-to-get-ready-for-ai","toc_title":"Defend against threats to get ready for AI"},{"href":"integrated-security-operations-data-billing-retention","toc_title":"Data ingestion and billing"},{"href":"onboard-isoc-workspace","toc_title":"Create an ISOC workspace"},{"children":[{"href":"content-hub-defender","toc_title":"Use Content hub"},{"href":"deploy-content-integrated-security-operations","toc_title":"Deploy content as code"}],"toc_title":"Manage security content"},{"children":[{"href":"siem-defender-automation","toc_title":"Overview"},{"href":"siem-defender-automation-integrations","toc_title":"Automation integrations"},{"href":"siem-defender-create-automation-rules","toc_title":"Create automation rules"},{"href":"siem-defender-generate-playbooks","toc_title":"Generate playbooks"}],"toc_title":"Automation rules and playbooks"},{"children":[{"href":"siem-defender-workbooks","toc_title":"Create and manage workbooks"},{"href":"defender-copilot-workbooks","toc_title":"Create and edit workbooks with Copilot"}],"toc_title":"Workbooks"},{"href":"extend-ueba","toc_title":"Add UEBA to Microsoft 365 E5 data"},{"href":"siem-defender-case-management","toc_title":"Case management"},{"children":[{"href":"defender-threat-intelligence","toc_title":"Overview"},{"href":"threat-intelligence-explorer","toc_title":"Intel explorer"},{"href":"query-threat-intelligence","toc_title":"Query threat intelligence"}],"toc_title":"Threat intelligence"}],"toc_title":"Integrated Security Operations Center (ISOC) (preview)"},{"children":[{"href":"/defender-endpoint/microsoft-defender-endpoint?toc=/defender-xdr/toc.json\u0026bc=/defender-xdr/breadcrumb/toc.json","toc_title":"Protect your endpoints"},{"href":"/defender-for-identity/what-is?toc=/defender-xdr/toc.json\u0026bc=/defender-xdr/breadcrumb/toc.json","toc_title":"Protect your identities"},{"href":"/defender-office-365/mdo-about?toc=/defender-xdr/toc.json\u0026bc=/defender-xdr/breadcrumb/toc.json","toc_title":"Protect your Office 365 workloads"},{"href":"/defender-cloud-apps/what-is-defender-for-cloud-apps?toc=/defender-xdr/toc.json\u0026bc=/defender-xdr/breadcrumb/toc.json","toc_title":"Protect your cloud apps"},{"href":"protect-against-iot-ot-threats","toc_title":"Protect your IoT/OT assets"},{"children":[{"href":"security-for-ai/defender-security-for-ai","toc_title":"Secure AI using Microsoft Defender"},{"children":[{"href":"security-for-ai/get-started-defender-security-for-ai","toc_title":"Enable security for AI agents using Microsoft Defender"},{"href":"security-for-ai/ai-agent-real-time-protection","toc_title":"Configure real-time agent protection and prompt evidence"},{"href":"security-for-ai/ai-agent-inventory","toc_title":"Agent discovery"},{"href":"security-for-ai/ai-agent-risk-assessment","toc_title":"AI agent risk posture"},{"href":"security-for-ai/ai-agent-detection-protection","toc_title":"Detect and investigate threats to AI agents"},{"href":"security-for-ai/privacy-defender-agent-365","toc_title":"Data privacy as part of Agent 365"},{"href":"security-for-ai/transition-agent-security-to-agent-365","toc_title":"Transition agent security to Agent 365"}],"toc_title":"Protect AI agents"}],"toc_title":"Protect your AI assets"}],"toc_title":"Protect workloads and assets"},{"children":[{"href":"microsoft-secure-score","toc_title":"Microsoft Secure Score overview"},{"href":"microsoft-secure-score-whats-new","toc_title":"What\u0027s new"},{"href":"microsoft-secure-score-improvement-actions","toc_title":"Assess your security posture"},{"href":"microsoft-secure-score-history-metrics-trends","toc_title":"Track your score history and meet goals"},{"href":"secure-score-data-storage-privacy","toc_title":"Data storage and privacy"}],"toc_title":"Assess and improve security posture"},{"children":[{"children":[{"href":"siem-defender-case-management","toc_title":"Overview"},{"children":[{"href":"manage-incident-cases","toc_title":"Manage incident cases"},{"href":"manage-incident-case-tasks","toc_title":"Manage incident case tasks"},{"href":"plan-incident-response","toc_title":"Plan incident response"},{"href":"prioritize-incident-cases","toc_title":"Prioritize incident cases"},{"href":"investigate-incident-cases","toc_title":"Investigate incident cases"},{"children":[{"href":"manage-incident-case-merging","toc_title":"Overview"},{"href":"merge-incident-cases-manually","toc_title":"Merge incident cases manually"},{"href":"move-alert-to-another-incident-case","toc_title":"Move alerts between incident cases"}],"toc_title":"Merge and split incident cases"},{"href":"/azure/sentinel/sentinel-security-copilot?toc=/defender-xdr/toc.json\u0026bc=/defender-xdr/breadcrumb/toc.json","toc_title":"Use Security Copilot with Microsoft Sentinel incidents"}],"toc_title":"Incident cases (preview)"},{"children":[{"href":"manage-cases","toc_title":"Manage generic cases"},{"href":"manage-generic-case-tasks","toc_title":"Manage generic case tasks"}],"toc_title":"Generic cases"},{"href":"case-sla-policies","toc_title":"SLA policies for cases (preview)"},{"href":"manage-case-templates","toc_title":"Configure case templates"},{"href":"audit-retain-case-data","toc_title":"Audit and retain case data (preview)"},{"href":"security-copilot-in-microsoft-365-defender?tabs=defender-chat","toc_title":"Use Microsoft Copilot in Defender with cases"}],"toc_title":"Cases"},{"children":[{"href":"incidents-overview","toc_title":"Overview"},{"href":"alerts-incidents-correlation","toc_title":"Correlation and merging"},{"href":"exclude-analytics-rules-correlation","toc_title":"Manage detection rule correlation settings"},{"href":"investigate-alerts","toc_title":"Investigate alerts"},{"href":"dynamic-threat-detection-agent","toc_title":"Use Dynamic Threat Detection Agent"}],"toc_title":"Incidents and alerts"},{"children":[{"href":"understand-graph-icons","toc_title":"Understand graph icons and visualizations"},{"children":[{"href":"investigate-users","toc_title":"Identity"},{"href":"entity-page-device","toc_title":"Device"},{"href":"entity-page-ip","toc_title":"IP"},{"href":"entity-page-threat-intelligence","toc_title":"View threat intelligence in entity pages"}],"toc_title":"Investigate entity pages"},{"href":"dlp-investigate-alerts-defender","toc_title":"Investigate data loss prevention alerts with Microsoft Defender XDR"},{"href":"dlp-investigate-alerts-sentinel","toc_title":"Investigate data loss prevention alerts with Microsoft Sentinel"},{"href":"investigate-respond-container-threats","toc_title":"Investigate and respond to container threats"},{"href":"irm-investigate-alerts-defender","toc_title":"Investigate insider risk threats"},{"href":"create-dsi-in-defender","toc_title":"Create data security investigations"}],"toc_title":"Investigate entities and security data"},{"children":[{"href":"incident-queue","toc_title":"Prioritize incidents"},{"href":"manage-incidents","toc_title":"Manage incidents"},{"href":"manually-create-incident","toc_title":"Manually create an incident or alert"},{"href":"split-incidents-into-tasks","toc_title":"Use tasks to handle incident workflow"},{"href":"investigate-incidents","toc_title":"Investigate incidents"},{"href":"move-alert-to-another-incident","toc_title":"Move alerts to another incident"},{"href":"merge-incidents-manually","toc_title":"Merge incidents manually"}],"toc_title":"Incident management (legacy)"}],"toc_title":"Investigate and respond"},{"children":[{"children":[{"href":"m365d-autoir","toc_title":"Overview"},{"href":"m365d-configure-auto-investigation-response","toc_title":"Configure capabilities"},{"href":"m365d-remediation-actions","toc_title":"Remediation actions"},{"href":"m365d-action-center","toc_title":"Use the Action center"},{"href":"m365d-autoir-actions","toc_title":"View and manage remediation actions"},{"href":"m365d-autoir-results","toc_title":"View details and results"},{"href":"m365d-autoir-report-false-positives-negatives","toc_title":"Address false positives and negatives"}],"toc_title":"Automated investigation and response"},{"children":[{"href":"automatic-attack-disruption","toc_title":"Overview"},{"href":"configure-attack-disruption","toc_title":"Manage"},{"href":"autoad-results","toc_title":"View details and results"},{"href":"automatic-attack-disruption-exclusions","toc_title":"Exclude assets from automated responses"},{"children":[{"href":"okta-attack-disruption","toc_title":"Enable attack disruption actions in Okta with Microsoft Sentinel (preview)"},{"href":"/azure/sentinel/aws-disruption?toc=/defender-xdr/toc.json\u0026bc=/defender-xdr/breadcrumb/toc.json","toc_title":"Enable attack disruption actions in AWS with Microsoft Sentinel (preview)"}],"toc_title":"External disruptions"}],"toc_title":"Attack disruption"},{"children":[{"href":"shield-predict-threats","toc_title":"Overview"},{"href":"shield-predict-threats-manage","toc_title":"Manage and view details"}],"toc_title":"Predictive shielding"}],"toc_title":"Automate investigation and response"},{"children":[{"href":"hunting-overview","toc_title":"Hunting overview"},{"children":[{"href":"advanced-hunting-overview","toc_title":"Overview"},{"href":"advanced-hunting-modes","toc_title":"Guided and advanced modes"},{"children":[{"href":"advanced-hunting-security-copilot","toc_title":"Overview"},{"href":"advanced-hunting-security-copilot-threat-hunting-assistant","toc_title":"Use the Threat Hunting Assistant"},{"href":"advanced-hunting-security-copilot-query-assistant","toc_title":"Generate KQL queries"}],"toc_title":"Hunt for threats with Security Copilot"},{"children":[{"href":"advanced-hunting-microsoft-defender","toc_title":"Microsoft Sentinel data in advanced hunting"},{"href":"advanced-hunting-defender-use-custom-rules","toc_title":"Use functions, saved queries, and custom rules"},{"href":"advanced-hunting-defender-results","toc_title":"Work with results containing Microsoft Sentinel data"}],"toc_title":"Hunt over Microsoft Sentinel data"},{"children":[{"href":"advanced-hunting-query-builder","toc_title":"Get started with query builder"},{"href":"advanced-hunting-query-builder-details","toc_title":"Refine your query in guided mode"},{"href":"advanced-hunting-query-builder-results","toc_title":"Work with query results in guided mode"}],"toc_title":"Build queries using guided mode"},{"children":[{"children":[{"href":"advanced-hunting-query-language","toc_title":"Learn the query language"},{"href":"advanced-hunting-expert-training","toc_title":"Get expert training"},{"href":"advanced-hunting-shared-queries","toc_title":"Use shared queries"},{"href":"advanced-hunting-query-emails-devices","toc_title":"Hunt across devices, emails, apps, and identities"},{"href":"advanced-hunting-find-ransomware","toc_title":"Hunt for ransomware"},{"href":"advanced-hunting-email-threats","toc_title":"Hunt for email threats"},{"href":"advanced-hunting-migrate-from-mde","toc_title":"Transition from Defender for Endpoint"}],"toc_title":"Learn, train, \u0026 get examples"},{"href":"advanced-hunting-go-hunt","toc_title":"Quickly investigate with go hunt"},{"href":"advanced-hunting-custom-functions","toc_title":"Create custom functions"},{"children":[{"href":"advanced-hunting-assignedipaddresses-function","toc_title":"AssignedIPAddresses()"},{"href":"advanced-hunting-devicefromip-function","toc_title":"DeviceFromIP()"},{"href":"advanced-hunting-fileprofile-function","toc_title":"FileProfile()"},{"href":"advanced-hunting-seenby-function","toc_title":"SeenBy()"},{"children":[{"href":"advanced-hunting-getfirstseenbehaviors-function","toc_title":"GetFirstSeenBehaviors()"},{"href":"advanced-hunting-getuncommonvaluebehaviors-function","toc_title":"GetUncommonValueBehaviors()"},{"href":"advanced-hunting-gethighvolumeanomalybehaviors-function","toc_title":"GetHighVolumeAnomalyBehaviors()"},{"href":"advanced-hunting-getanomalousbehaviorsbykind-function","toc_title":"GetAnomalousBehaviorsByKind()"},{"href":"advanced-hunting-getanomalousbehaviorsbyvalue-function","toc_title":"GetAnomalousBehaviorsByValue()"},{"href":"advanced-hunting-getanomalousbehaviorsabout-function","toc_title":"GetAnomalousBehaviorsAbout()"}],"toc_title":"UEBA behavior insights"}],"toc_title":"Use built-in functions"},{"children":[{"href":"advanced-hunting-best-practices","toc_title":"Apply query best practices"},{"href":"advanced-hunting-errors","toc_title":"Handle errors"}],"toc_title":"Optimize \u0026 handle errors"}],"toc_title":"Create queries using advanced mode"},{"href":"advanced-hunting-query-results","toc_title":"Work with query results"},{"href":"advanced-hunting-query-history","toc_title":"Rerun query in query history"},{"children":[{"href":"advanced-hunting-schema-tables","toc_title":"Understand the schema"},{"href":"advanced-hunting-schema-changes","toc_title":"Schema naming changes"},{"href":"advanced-hunting-aadsignineventsbeta-table","toc_title":"AADSignInEventsBeta"},{"href":"advanced-hunting-aadspnsignineventsbeta-table","toc_title":"AADSpnSignInEventsBeta"},{"href":"advanced-hunting-agentsinfo-table","toc_title":"AgentsInfo"},{"href":"advanced-hunting-alertevidence-table","toc_title":"AlertEvidence"},{"href":"advanced-hunting-alertinfo-table","toc_title":"AlertInfo"},{"href":"advanced-hunting-behaviorentities-table","toc_title":"BehaviorEntities"},{"href":"advanced-hunting-behaviorinfo-table","toc_title":"BehaviorInfo"},{"href":"advanced-hunting-callactivityevents-table","toc_title":"CallActivityEvents"},{"href":"advanced-hunting-campaigninfo-table","toc_title":"CampaignInfo"},{"href":"advanced-hunting-cloudappevents-table","toc_title":"CloudAppEvents"},{"href":"advanced-hunting-cloudauditevents-table","toc_title":"CloudAuditEvents"},{"href":"advanced-hunting-clouddnsevents-table","toc_title":"CloudDnsEvents"},{"href":"advanced-hunting-cloudkeyvaultevents-table","toc_title":"CloudKeyVaultEvents"},{"href":"advanced-hunting-cloudpolicyenforcementevents-table","toc_title":"CloudPolicyEnforcementEvents"},{"href":"advanced-hunting-cloudprocessevents-table","toc_title":"CloudProcessEvents"},{"href":"advanced-hunting-cloudstorageaggregatedevents-table","toc_title":"CloudStorageAggregatedEvents"},{"href":"advanced-hunting-datasecuritybehaviors-table","toc_title":"DataSecurityBehaviors"},{"href":"advanced-hunting-datasecurityevents-table","toc_title":"DataSecurityEvents"},{"href":"advanced-hunting-devicebaselinecomplianceassessment-table","toc_title":"DeviceBaselineComplianceAssessment"},{"href":"advanced-hunting-devicebaselinecomplianceassessmentkb-table","toc_title":"DeviceBaselineComplianceAssessmentKB"},{"href":"advanced-hunting-devicebaselinecomplianceprofiles-table","toc_title":"DeviceBaselineComplianceProfiles"},{"href":"advanced-hunting-deviceevents-table","toc_title":"DeviceEvents"},{"href":"advanced-hunting-devicefilecertificateinfo-table","toc_title":"DeviceFileCertificateInfo"},{"href":"advanced-hunting-devicefileevents-table","toc_title":"DeviceFileEvents"},{"href":"advanced-hunting-deviceimageloadevents-table","toc_title":"DeviceImageLoadEvents"},{"href":"advanced-hunting-deviceinfo-table","toc_title":"DeviceInfo"},{"href":"advanced-hunting-devicelogonevents-table","toc_title":"DeviceLogonEvents"},{"href":"advanced-hunting-devicenetworkevents-table","toc_title":"DeviceNetworkEvents"},{"href":"advanced-hunting-devicenetworkinfo-table","toc_title":"DeviceNetworkInfo"},{"href":"advanced-hunting-deviceprocessevents-table","toc_title":"DeviceProcessEvents"},{"href":"advanced-hunting-deviceregistryevents-table","toc_title":"DeviceRegistryEvents"},{"href":"advanced-hunting-devicetvmbrowserextensions-table","toc_title":"DeviceTvmBrowserExtensions"},{"href":"advanced-hunting-devicetvmbrowserextensionskb-table","toc_title":"DeviceTvmBrowserExtensionsKB"},{"href":"advanced-hunting-devicetvmcertificateinfo-table","toc_title":"DeviceTvmCertificateInfo"},{"href":"advanced-hunting-devicetvmhardwarefirmware-table","toc_title":"DeviceTvmHardwareFirmware"},{"href":"advanced-hunting-devicetvminfogathering-table","toc_title":"DeviceTvmInfoGathering"},{"href":"advanced-hunting-devicetvminfogatheringkb-table","toc_title":"DeviceTvmInfoGatheringKB"},{"href":"advanced-hunting-devicetvmsecureconfigurationassessment-table","toc_title":"DeviceTvmSecureConfigurationAssessment"},{"href":"advanced-hunting-devicetvmsecureconfigurationassessmentkb-table","toc_title":"DeviceTvmSecureConfigurationAssessmentKB"},{"href":"advanced-hunting-devicetvmsoftwareevidencebeta-table","toc_title":"DeviceTvmSoftwareEvidenceBeta"},{"href":"advanced-hunting-devicetvmsoftwareinventory-table","toc_title":"DeviceTvmSoftwareInventory"},{"href":"advanced-hunting-devicetvmsoftwarevulnerabilities-table","toc_title":"DeviceTvmSoftwareVulnerabilities"},{"href":"advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table","toc_title":"DeviceTvmSoftwareVulnerabilitiesKB"},{"href":"advanced-hunting-disruptionandresponseevents-table","toc_title":"DisruptionAndResponseEvents"},{"href":"advanced-hunting-emailattachmentinfo-table","toc_title":"EmailAttachmentInfo"},{"href":"advanced-hunting-emailevents-table","toc_title":"EmailEvents"},{"href":"advanced-hunting-emailpostdeliveryevents-table","toc_title":"EmailPostDeliveryEvents"},{"href":"advanced-hunting-emailurlinfo-table","toc_title":"EmailUrlInfo"},{"href":"advanced-hunting-entraidsigninevents-table","toc_title":"EntraIdSignInEvents"},{"href":"advanced-hunting-entraidspnsigninevents-table","toc_title":"EntraIdSpnSignInEvents"},{"href":"advanced-hunting-exposuregraphedges-table","toc_title":"ExposureGraphEdges"},{"href":"advanced-hunting-exposuregraphnodes-table","toc_title":"ExposureGraphNodes"},{"href":"advanced-hunting-filemaliciouscontentinfo-table","toc_title":"FileMaliciousContentInfo"},{"href":"advanced-hunting-graphapiauditevents-table","toc_title":"GraphApiAuditEvents"},{"href":"advanced-hunting-identityaccountinfo-table","toc_title":"IdentityAccountInfo"},{"href":"advanced-hunting-identitydirectoryevents-table","toc_title":"IdentityDirectoryEvents"},{"href":"advanced-hunting-identityevents-table","toc_title":"IdentityEvents"},{"href":"advanced-hunting-identityinfo-table","toc_title":"IdentityInfo"},{"href":"advanced-hunting-identitylogonevents-table","toc_title":"IdentityLogonEvents"},{"href":"advanced-hunting-identityqueryevents-table","toc_title":"IdentityQueryEvents"},{"href":"advanced-hunting-messagecontents-table","toc_title":"MessageContents"},{"href":"advanced-hunting-messageevents-table","toc_title":"MessageEvents"},{"href":"advanced-hunting-messagepostdeliveryevents-table","toc_title":"MessagePostDeliveryEvents"},{"href":"advanced-hunting-messageurlinfo-table","toc_title":"MessageUrlInfo"},{"href":"advanced-hunting-oauthappinfo-table","toc_title":"OAuthAppInfo"},{"href":"advanced-hunting-urlclickevents-table","toc_title":"UrlClickEvents"}],"toc_title":"Data schema"},{"children":[{"href":"custom-detections-overview","toc_title":"Custom detections overview"},{"href":"custom-detection-rules","toc_title":"Create detection rules"},{"href":"custom-detection-manage","toc_title":"Manage detection rules"}],"toc_title":"Custom detections"},{"href":"advanced-hunting-take-action","toc_title":"Take action on query results"},{"href":"advanced-hunting-link-to-incident","toc_title":"Link query results to an incident"},{"href":"advanced-hunting-limits","toc_title":"Find resource-heavy queries"},{"href":"advanced-hunting-extend-data","toc_title":"Extend data coverage"},{"href":"advanced-hunting-graph","toc_title":"Hunt using hunting graph"}],"toc_title":"Advanced hunting"}],"toc_title":"Analyze data and hunt for threats"},{"children":[{"href":"defender-threat-intelligence","toc_title":"Overview"},{"href":"threat-intelligence-explorer","toc_title":"Intel explorer"},{"href":"query-threat-intelligence","toc_title":"Query threat intelligence"},{"href":"threat-intelligence-transition","toc_title":"Transition to the new Threat intelligence experience"},{"children":[{"href":"threat-analytics","toc_title":"Overview"},{"href":"threat-analytics-analyst-reports","toc_title":"Understand the analyst report"},{"href":"threat-analytics-indicators","toc_title":"Get access to indicators"}],"toc_title":"Threat analytics reports"},{"href":"security-copilot-and-defender-threat-intelligence","toc_title":"Use Security Copilot for threat intelligence"}],"toc_title":"Threat intelligence"},{"children":[{"href":"security-copilot-in-microsoft-365-defender","toc_title":"Overview"},{"href":"security-copilot-m365d-incident-summary","toc_title":"Summarize incidents"},{"href":"security-copilot-m365d-script-analysis","toc_title":"Run script analysis"},{"href":"copilot-in-defender-file-analysis","toc_title":"Analyze files"},{"href":"copilot-in-defender-device-summary","toc_title":"Generate device summaries"},{"href":"security-copilot-defender-identity-summary","toc_title":"Summarize identities"},{"href":"security-copilot-m365d-guided-response","toc_title":"Use guided responses"},{"href":"advanced-hunting-security-copilot-query-assistant","toc_title":"Generate KQL queries"},{"href":"security-copilot-m365d-create-incident-report","toc_title":"Create incident reports"},{"href":"application-card-copilot-defender","toc_title":"Application card"},{"href":"responsible-ai-copilot-defender","toc_title":"Responsible AI FAQs"},{"children":[{"href":"security-copilot-agents-defender","toc_title":"Overview"},{"href":"phishing-triage-agent","toc_title":"Phishing Triage Agent"},{"href":"security-alert-triage-agent","toc_title":"Security Alert Triage Agent (preview)"},{"href":"threat-intel-briefing-agent-defender","toc_title":"Threat Intelligence Briefing Agent"},{"href":"advanced-hunting-security-copilot-threat-hunting-assistant","toc_title":"Threat Hunting Assistant"},{"href":"dynamic-threat-detection-agent","toc_title":"Dynamic Threat Detection Agent"},{"href":"security-analyst-agent","toc_title":"Security Analyst Agent"}],"toc_title":"Security Copilot agents in Microsoft Defender"}],"toc_title":"Microsoft Copilot in Defender"},{"children":[{"href":"identity-security/identity-security-overview","toc_title":"Identity Security overview"},{"href":"identity-security/coverage-maturity","toc_title":"View your identity coverage and maturity"},{"children":[{"href":"/defender-for-identity/dashboard?toc=/defender-xdr/toc.json\u0026bc=/defender-xdr/breadcrumb/toc.json","toc_title":"The identity security dashboard"},{"href":"/defender-for-identity/identity-inventory?toc=/defender-xdr/toc.json\u0026bc=/defender-xdr/breadcrumb/toc.json","toc_title":"View the identity inventory"},{"href":"investigate-users","toc_title":"Investigate a human identity"},{"href":"investigate-non-human-identities","toc_title":"Investigate a non-human identity"},{"href":"/defender-for-identity/investigate-domain?toc=/defender-xdr/toc.json\u0026bc=/defender-xdr/breadcrumb/toc.json","toc_title":"Investigate an Active Directory domain"}],"toc_title":"View your identities"},{"children":[{"href":"/defender-for-identity/identity-security-initiative?toc=/defender-xdr/toc.json\u0026bc=/defender-xdr/breadcrumb/toc.json","toc_title":"Identity security initiative (preview)"},{"href":"identity-security/identity-security-recommendations","toc_title":"Unified identity security recommendations"}],"toc_title":"Security recommendations"}],"toc_title":"Identity security"},{"children":[{"href":"defender-experts/defender-experts-overview","toc_title":"Overview"},{"children":[{"href":"defender-experts/defender-experts-hunting-overview","toc_title":"Overview"},{"href":"defender-experts/defender-experts-hunting-prerequisites","toc_title":"Before you begin"},{"children":[{"href":"defender-experts/defender-experts-hunting-onboarding","toc_title":"Onboard and set up Defender Experts Notifications"},{"href":"defender-experts/defender-experts-hunting-graph-api","toc_title":"Access Defender Experts Notifications using Graph security API"},{"href":"defender-experts/defender-experts-hunting-ask-experts","toc_title":"Ask Defender Experts"},{"href":"defender-experts/defender-experts-hunting-hunts","toc_title":"View hunts in Defender Experts Hunting"},{"href":"defender-experts/defender-experts-hunting-report","toc_title":"Understand Defender Experts Hunting reports"},{"href":"defender-experts/defender-experts-mssp-guide","toc_title":"Work with MSSPs"}],"toc_title":"Start using Defender Experts Hunting"},{"children":[{"href":"defender-experts/defender-experts-teams-app-permissions","toc_title":"Troubleshooting Defender Experts app permissions in Microsoft Teams"},{"href":"defender-experts/defender-experts-hunting-faq","toc_title":"General information"},{"href":"defender-experts/defender-experts-faq-cloud-coverage","toc_title":"Server and cloud workload coverage"}],"toc_title":"Frequently asked questions"}],"toc_title":"Defender Experts Hunting"},{"children":[{"href":"defender-experts/defender-experts-mdr-overview","toc_title":"Overview"},{"href":"defender-experts/defender-experts-mdr-prerequisites","toc_title":"Before you begin"},{"href":"defender-experts/defender-experts-mdr-get-started","toc_title":"Get started with Defender Experts MDR"},{"children":[{"href":"defender-experts/defender-experts-mdr-start-using","toc_title":"Overview"},{"href":"defender-experts/defender-experts-mdr-managed-response","toc_title":"Managed detection and response"},{"href":"defender-experts/defender-experts-mdr-scoped-coverage","toc_title":"Scoped coverage"},{"href":"defender-experts/defender-experts-mdr-communication","toc_title":"Communicate with Defender Experts"},{"href":"defender-experts/defender-experts-mdr-reports","toc_title":"Reports"},{"href":"defender-experts/defender-experts-mdr-third-party-enrichment","toc_title":"Third-party enrichment"},{"href":"defender-experts/defender-experts-hunting-overview","toc_title":"Defender Experts Hunting"},{"href":"defender-experts/defender-experts-mdr-auditing","toc_title":"Auditing"},{"href":"defender-experts/defender-experts-mssp-guide","toc_title":"Work with MSSPs"}],"toc_title":"Start using Defender Experts MDR"},{"children":[{"children":[{"href":"defender-experts/defender-experts-mdr-faq","toc_title":"General information"},{"href":"defender-experts/defender-experts-mdr-faq-managed-response","toc_title":"Managed response"}],"toc_title":"Frequently asked questions"},{"href":"defender-experts/defender-experts-mdr-considerations","toc_title":"Important considerations"},{"href":"defender-experts/defender-experts-mdr-permissions","toc_title":"How Defender Experts MDR permissions work"},{"href":"defender-experts/defender-experts-teams-app-permissions","toc_title":"Troubleshooting Defender Experts app permissions in Microsoft Teams"}],"toc_title":"Additional information on Defender Experts MDR"}],"toc_title":"Defender Experts MDR"},{"children":[{"href":"defender-experts/defender-experts-servers-overview","toc_title":"Overview"},{"href":"defender-experts/defender-experts-servers-get-started","toc_title":"Get started with Defender Experts for Servers"},{"href":"defender-experts/defender-experts-faq-cloud-coverage","toc_title":"Frequently asked questions"}],"toc_title":"Defender Experts for Servers"}],"toc_title":"Microsoft Defender Experts"},{"children":[{"href":"mto-overview","toc_title":"Overview"},{"children":[{"href":"playbook-managed-security","toc_title":"Managed security service provider playbook"},{"href":"governance-relationships","toc_title":"Governance relationships"},{"href":"mto-requirements","toc_title":"Set up multitenant management"}],"toc_title":"Plan multitenant management"},{"children":[{"href":"mto-tenants","toc_title":"Manage tenants"},{"href":"mto-tenant-groups","toc_title":"Manage tenant groups"},{"href":"mto-cross-cloud","toc_title":"Manage tenants across clouds"}],"toc_title":"Manage tenants"},{"children":[{"href":"mto-incidents-alerts","toc_title":"Manage incidents and alerts"},{"href":"mto-manage-cases","toc_title":"Manage cases"},{"href":"mto-advanced-hunting","toc_title":"Advanced hunting"}],"toc_title":"Investigate across tenants"},{"children":[{"href":"mto-tenant-devices","toc_title":"Manage devices"},{"displayName":"MTO","href":"multitenant-identities-inventory","toc_title":"Manage identities"},{"href":"mto-dashboard","toc_title":"Vulnerability management dashboard"}],"toc_title":"Manage assets across tenants"},{"children":[{"href":"mto-endpoint-security-policy","toc_title":"Manage endpoint security policies"},{"href":"mto-distribution-profiles","toc_title":"Manage distribution profiles"},{"href":"mto-workbooks","toc_title":"Workbooks"},{"href":"mto-urbac","toc_title":"Unified RBAC"}],"toc_title":"Manage security across tenants"},{"href":"mto-troubleshoot","toc_title":"Troubleshoot"}],"toc_title":"Manage multitenant environments"},{"children":[{"children":[{"href":"m365d-permissions","toc_title":"Manage access"},{"href":"custom-roles","toc_title":"Custom roles in role-based access"}],"toc_title":"Manage access and roles in Microsoft Defender XDR"},{"children":[{"href":"manage-rbac","toc_title":"Overview"},{"href":"whats-new-in-microsoft-defender-urbac","toc_title":"What\u0027s new"},{"href":"scoping","toc_title":"Configure Microsoft Sentinel scoping (row-level RBAC)"},{"href":"create-custom-rbac-roles","toc_title":"Create custom roles"},{"href":"import-rbac-roles","toc_title":"Import roles"},{"href":"activate-defender-rbac","toc_title":"Activate Defender unified RBAC"},{"href":"edit-delete-rbac-roles","toc_title":"Edit, delete and export roles"},{"href":"compare-rbac-roles","toc_title":"Map Defender unified RBAC permissions"},{"href":"custom-permissions-details","toc_title":"About Defender unified RBAC custom permissions"}],"toc_title":"Manage permissions with Defender unified RBAC"}],"toc_title":"Manage roles and permissions"},{"children":[{"href":"m365d-enable-faq","toc_title":"Microsoft Defender XDR FAQs"},{"href":"alert-policies","toc_title":"Alert policies"},{"href":"microsoft-xdr-auditing","toc_title":"Audit activities and events"},{"href":"configure-asset-rules","toc_title":"Manage devices through dynamic rules"},{"href":"defender-xdr-custom-reports","toc_title":"Create Custom Defender XDR reports"},{"href":"security-summary-report","toc_title":"Visualize impact with the unified security summary"},{"children":[{"href":"m365d-notifications-incidents","toc_title":"Get notified about new and updated incidents"},{"href":"m365d-response-actions-notifications","toc_title":"Set up email notifications for response actions"},{"href":"m365d-threat-analytics-notifications","toc_title":"Set up email notifications for Threat analytics reports"},{"href":"configure-email-notifications","toc_title":"Configure alert notifications"}],"toc_title":"Notifications"},{"children":[{"href":"contact-defender-support","toc_title":"Contact Microsoft Defender support"},{"href":"troubleshoot","toc_title":"Troubleshoot service issues"}],"toc_title":"Support and troubleshooting"},{"children":[{"children":[{"href":"api-overview","toc_title":"Overview"},{"href":"api-supported","toc_title":"Supported Microsoft Defender XDR APIs"},{"children":[{"href":"/legal/microsoft-365/api-terms","toc_title":"Microsoft Defender XDR API license and terms of use"},{"href":"api-access","toc_title":"Access Microsoft Defender XDR APIs"},{"href":"api-hello-world","toc_title":"Hello World example"},{"href":"api-create-app-web","toc_title":"Get access with application context"},{"href":"api-create-app-user-context","toc_title":"Get access with user context"},{"href":"api-partner-access","toc_title":"Get partner application access"},{"href":"api-articles","toc_title":"Other API resources"}],"toc_title":"Get started"},{"children":[{"href":"api-error-codes","toc_title":"Common REST API error codes"},{"children":[{"href":"streaming-api","toc_title":"Microsoft 365 streaming API"},{"href":"streaming-api-event-hub","toc_title":"Stream advanced hunting events to Azure Events hub"},{"href":"streaming-api-storage","toc_title":"Stream advanced hunting events to your storage account"},{"href":"supported-event-types","toc_title":"Supported streaming event types"},{"href":"configure-event-hub","toc_title":"Configure your Event hub"}],"toc_title":"Streaming API"},{"href":"api-advanced-hunting","toc_title":"Advanced hunting API"},{"href":"/graph/api/resources/security-api-overview?view=graph-rest-beta\u0026preserve-view=true#custom-detections","toc_title":"Custom detections API"},{"children":[{"href":"api-incident","toc_title":"Incidents methods and properties"},{"href":"api-list-incidents","toc_title":"List incidents"},{"href":"api-update-incidents","toc_title":"Update incidents"},{"href":"api-get-incident","toc_title":"Get Incident"}],"toc_title":"Incidents APIs"}],"toc_title":"Microsoft Defender XDR APIs and schema"},{"href":"fetch-incidents","toc_title":"Fetch Microsoft Defender XDR incidents"}],"toc_title":"Microsoft Defender XDR APIs"},{"children":[{"href":"configure-siem-defender","toc_title":"Integrate your SIEM tools with Microsoft Defender XDR"},{"href":"/defender-endpoint/troubleshoot-siem","toc_title":"Troubleshoot issues with integrating SIEM tools"}],"toc_title":"SIEM integration"}],"toc_title":"APIs and integrations"},{"children":[{"href":"mssp-access","toc_title":"Provide managed service provider (MSSP) access"},{"href":"/defender-endpoint/technological-partners","toc_title":"Technological partners of Microsoft Defender XDR"},{"href":"/defender-endpoint/professional-services","toc_title":"Professional services supported by Microsoft Defender XDR"}],"toc_title":"Partners and service providers"}],"toc_title":"Reference"},{"children":[{"children":[{"href":"alert-classification-playbooks","toc_title":"Overview"},{"href":"alert-grading-playbook-email-forwarding","toc_title":"Suspicious email forwarding activity"},{"href":"alert-grading-playbook-inbox-forwarding-rules","toc_title":"Suspicious inbox forwarding rules"},{"href":"alert-grading-playbook-inbox-manipulation-rules","toc_title":"Suspicious inbox manipulation rules"},{"href":"alert-classification-suspicious-ip-password-spray","toc_title":"Suspicious password-spray-related IP address"},{"href":"alert-classification-malicious-exchange-connectors","toc_title":"Malicious Exchange connectors"},{"href":"alert-classification-password-spray-attack","toc_title":"Password spray attacks"}],"toc_title":"Alert classification playbooks"},{"href":"/security/operations/incident-response-playbooks","toc_title":"Incident response playbooks"},{"href":"security-upload-guide","toc_title":"Customize incident responses"},{"href":"sop-documentation-template","toc_title":"SOP template - Compromised identity"},{"children":[{"href":"playbook-detecting-ransomware-m365-defender","toc_title":"Detecting human-operated ransomware attacks with Microsoft Defender XDR"},{"href":"playbook-responding-ransomware-m365-defender","toc_title":"Responding to ransomware attacks"}],"toc_title":"Ransomware playbooks"},{"children":[{"href":"microsoft-threat-actor-naming","toc_title":"Threat actor naming"},{"href":"malware-naming","toc_title":"How Microsoft names malware"},{"href":"criteria","toc_title":"How Microsoft identifies malware and potentially unwanted applications"},{"href":"/defender-endpoint/threat-indicator-concepts","toc_title":"Understand threat intelligence concepts"}],"toc_title":"Threat and malware reference"},{"href":"submission-guide","toc_title":"Submit files for analysis by Microsoft"},{"href":"virus-initiative-criteria","toc_title":"Microsoft Virus Initiative"},{"href":"developer-faq","toc_title":"Software developer FAQ"}],"toc_title":"Guides and resources"},{"children":[{"href":"/defender-office-365","toc_title":"Defender for Office 365"},{"href":"/defender-endpoint","toc_title":"Defender for Endpoint"},{"href":"/defender-for-identity","toc_title":"Defender for Identity"},{"href":"/cloud-app-security","toc_title":"Defender for Cloud Apps"},{"href":"/defender-business","toc_title":"Defender for Business"},{"href":"/defender-vulnerability-management","toc_title":"Defender Vulnerability Management"}],"toc_title":"Related Defender documentation"}],"expanded":true,"href":"./","toc_title":"Microsoft Defender XDR"}],"metadata":{"breadcrumb_path":"/defender-xdr/breadcrumb/toc.json","count_of_node_with_href":388,"extendBreadcrumb":false,"feedback_product_url":"https://techcommunity.microsoft.com/t5/microsoft-365-defender/bd-p/MicrosoftThreatProtection","feedback_system":"Standard","manager":"orspodek","open_to_public_contributors":false,"permissioned-type":"public","searchScope":["Defender XDR"],"titleSuffix":"Microsoft Defender XDR","uhfHeaderId":"MSDocsHeader-MicrosoftDefender"}}