Defender XDR and attack-surface management

Microsoft Defender XDR (Extended Detection and Response) is the unified portal and engine that ties Microsoft's Defender products together: Defender for Office 365 (email), Defender for Endpoint (devices), Defender for Identity (AD/Entra), Defender for Cloud Apps (SaaS), and — through integration — Defender for Cloud (Azure workloads), Defender for IoT (OT and IoT devices), and Microsoft Sentinel (SIEM).

Why XDR matters

A modern attack rarely touches only one workload. A phishing email leads to credential theft, which leads to a sign-in from a new device, which leads to lateral movement on AD, which leads to data exfiltration via a sanctioned SaaS app. Each of those events is detected by a different product, but to a human analyst they're one incident.

XDR's core trick is correlation: it groups related alerts from different products into a single incident, with the full timeline, affected entities, and recommended response actions.

The XDR portal

The Defender XDR portal at security.microsoft.com is one place for:

Incidents and alerts — correlated, prioritised, with full attack timelines.
Advanced hunting — Kusto Query Language (KQL) across all Defender telemetry.
Automated investigation and response (AIR) — playbooks that triage and remediate automatically.
Threat analytics — Microsoft Threat Intelligence reports with tenant-specific exposure.
Attack surface management — discovery of internet-facing assets and weaknesses.
Email and collaboration — quarantine, submissions, message trace.
Endpoints — device inventory, vulnerability management, response actions.
Identities — account-centric view of risk and detections.
Cloud apps — connected app inventory and SSPM findings.

Microsoft Sentinel integration

Sentinel is Microsoft's full SIEM/SOAR. It now lives inside the Defender XDR portal as a unified surface: Defender XDR for first-party signals, Sentinel for broader log ingestion (third-party firewalls, network gear, custom apps) and longer retention. The same KQL hunts work across both.

Microsoft Security Copilot

Microsoft Security Copilot is a paid AI assistant for SOC analysts, embedded in Defender XDR. It can summarise an incident in plain English, suggest hunting queries, write KQL from natural-language descriptions, and draft incident reports. It's an add-on to Defender XDR, billed per Security Compute Unit (SCU) per hour.

Operational model

XDR works best when the SOC organises around it:

A small team of analysts triage incidents in the portal, escalating from low to high priority.
AIR playbooks handle the routine cases (clear phishing, common malware).
Advanced hunting and threat-intel-driven proactive hunts catch what detections miss.
Lessons feed back into Conditional Access, ASR rules, and Purview policies — closing the loop.

For Microsoft 365 customers on E5, XDR is the centrepiece of the security stack. It's where the investment pays off.