The How of Defender Products

How does Defender XDR work?

Collects and correlates signals from the different products

How does Defender for Endpoint work?

Endpoint Detection and Response tracks behaviour patterns.

Automatically investigates alerts.

Automatically responds.

How does Defender for Office 365 work?

Scans and rewrites URLs in emails and documents

Detonates attachments

Identifies and blocks phishing attempts

Automated investigation

How does Defender for Identity work?

Collects identity related data

Creates a baseline behaviour pattern

Identifies suspicious behaviour and known attack patterns

How does defender for Cloud Apps work?

Identifies and manages unsanctioned or high risk apps

Monitors file uploads/downloads/sharing, logins and admin actions

Detects compromised accounts and suspicious behaviour

Creates and enforces policies

How does defender for Cloud work?

Evaluates cloud configurations and identifies risks

Provides threat protection

How does Entra ID Protection work?

Detects risky behaviour such as anonymous IP usage, password spraying, leaked credentials

Assigns a risk level to each sign in

Tracks risks

Automatic remediation

How does Defender for Vulnerability Management work?

Continuously discovers and assesses vulnerabilities

Prioritises vulnerabilities based on active exploitation, exposure and criticality to assets

How does Defender for IoT work?

Identifies the devices

Prioritises vulnerabilities and attack paths

Detects anomalies and attacks

How does Sentinel work?

Collects data from the different microsoft services

Threat detection

Investigation

Automated response

Threat hunting

Integrates with defender for a unified SOC