Microsoft Defender and XDR

What each Defender product actually protects, how the XDR story ties them together, and where to hunt when something breaks.

For: Security ops teams and admins responsible for the Microsoft security stack.

10 guides in this path

  1. 1
    Which Microsoft Defender is whichMicrosoft ships at least ten products called Defender. A field guide to the whole family — Endpoint, Office 365, Identity, Cloud Apps, Business, XDR, Cloud, Antivirus, and the rest — what each one actually does, and which licence gets you what.
  2. 2
    Microsoft Defender for Endpoint explainedDefender for Endpoint is Microsoft's EDR/XDR platform for laptops, servers, and mobile. Here's what it does.
  3. 3
    Microsoft Defender for Office 365 explainedWhat Defender for Office 365 adds on top of EOP — Safe Links, Safe Attachments, AIR, attack simulation — plus Plan 1 vs Plan 2 and the settings worth tuning.
  4. 4
    Microsoft Defender for Identity explainedDefender for Identity detects identity-based attacks against on-prem Active Directory and Entra ID. Here's how it works.
  5. 5
    Microsoft Defender for Cloud Apps explainedDefender for Cloud Apps is Microsoft's CASB — discovering, monitoring, and controlling SaaS app usage.
  6. 6
    Defender XDR and attack-surface managementHow Microsoft Defender XDR unifies Defender for Office, Endpoint, Identity, and Cloud Apps into a single SOC workflow.
  7. 7
    Defender XDR advanced hunting workshopHow to use Defender XDR advanced hunting effectively — tables, common queries, and threat-hunting patterns.
  8. 8
    Defender for Office 365 quarantine workflowHow users and admins work with quarantine — release, request, report, and the policy decisions behind it.
  9. 9
    Defender Attack DisruptionAutomatic Attack Disruption is Defender XDR's ability to contain in-progress attacks automatically — what it does and how.
  10. 10
    Defender Threat IntelligenceHow Microsoft Defender XDR integrates threat intelligence — built-in feeds, custom IoCs, and Defender TI as a separate product.
← All pathsBrowse all guides →