`, *Bearer* being the authorization scheme, and *token* being your validated token.
3. The token will expire within one hour. You can send more than one request during this time with the same token.
@@ -278,8 +278,8 @@ The following example shows how to send a request to get a list of incidents **u
## Related articles
-- [Microsoft Defender XDR APIs overview](api-overview.md)
-- [Access the Microsoft Defender XDR APIs](api-access.md)
+- [Microsoft Defender APIs overview](api-overview.md)
+- [Access the Microsoft Defender APIs](api-access.md)
- [Create a 'Hello world' application](api-hello-world.md)
- [Create an app to access Microsoft Defender XDR without a user](api-create-app-web.md)
- [Create an app to access Microsoft Defender XDR APIs on behalf of a user](api-create-app-user-context.md)
diff --git a/defender-xdr/api-update-incidents.md b/defender-xdr/api-update-incidents.md
index b17578e5704..af8f7f0636d 100644
--- a/defender-xdr/api-update-incidents.md
+++ b/defender-xdr/api-update-incidents.md
@@ -39,7 +39,7 @@ If your request is throttled, it returns a `429` response code. The response bod
## Permissions
-One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Access the Microsoft Defender XDR APIs](api-access.md).
+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Access the Microsoft Defender APIs](api-access.md).
Permission type|Permission|Permission display name
---|---|---
diff --git a/defender-xdr/autoad-results.md b/defender-xdr/autoad-results.md
index 7cc4baa0cd1..e1aa6ebb78c 100644
--- a/defender-xdr/autoad-results.md
+++ b/defender-xdr/autoad-results.md
@@ -29,7 +29,7 @@ When automatic attack disruption triggers in Microsoft Defender XDR, you can vie
## Review the incident graph
-Microsoft Defender XDR automatic attack disruption is built into the incident view. Review the incident graph to get the entire attack story and assess the attack disruption impact and status.
+Microsoft Defender automatic attack disruption is built into the incident view. Review the incident graph to get the entire attack story and assess the attack disruption impact and status.
The incident page includes the following information:
@@ -119,7 +119,7 @@ Containment in Microsoft Defender for Endpoint prevents further threat actor act
Attack disruption uses the remediation action capability of Microsoft Defender for Identity to disable accounts. By default, Microsoft Defender for Identity uses the LocalSystem account of the domain controller for all remediation actions.
-The following query looks for events where a domain controller disabled user accounts. This query also returns user accounts disabled by automatic attack disruption by manually triggering account disable in Microsoft Defender XDR:
+The following query looks for events where a domain controller disabled user accounts. This query also returns user accounts disabled by automatic attack disruption by manually triggering account disable in Microsoft Defender:
```Kusto
let AllDomainControllers =
diff --git a/defender-xdr/automatic-attack-disruption-exclusions.md b/defender-xdr/automatic-attack-disruption-exclusions.md
index 5b745e5e229..17ac52dcdc1 100644
--- a/defender-xdr/automatic-attack-disruption-exclusions.md
+++ b/defender-xdr/automatic-attack-disruption-exclusions.md
@@ -11,9 +11,11 @@ ms.collection:
- usx-security
- usx-security
ms.topic: how-to
-ms.date: 05/12/2025
+ms.date: 06/25/2026
appliesto:
- Microsoft Defender XDR
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1014
#customer intent: As a security administrator, I want to learn how to exclude specific assets from being automatically contained by automatic attack disruption in Microsoft Defender XDR, so that I can prevent disruptions to critical assets while still maintaining security.
---
@@ -31,11 +33,26 @@ Automatic attack disruption and exclusion policies work together to help contain
## Prerequisites
-To configure automated response settings or to add or edit device tags, you must be a **Security Administrator or higher** in either [Microsoft Entra ID](https://portal.azure.com) or in the [Microsoft 365 admin center](https://admin.microsoft.com).
+The permissions required to manage attack disruption exclusions depend on whether [Microsoft Defender XDR Unified role-based access control (RBAC)](manage-rbac.md) is enabled for the relevant workload.
-A Security Reader and view tags but not edit them.
+### Device exclusions
-A Security operator can trigger manual incestigations but can't change automation settings.
+| Unified RBAC for endpoints | Required permission |
+| --- | --- |
+| **Disabled** | Security Administrator or Global Administrator role in [Microsoft Entra ID](https://entra.microsoft.com) or the [Microsoft 365 admin center](https://admin.microsoft.com). |
+| **Enabled** | Security Operator (or higher) global Microsoft Entra role, **or** the [Core security settings (manage)](custom-permissions-details.md) permission in Unified RBAC. |
+
+For more information, see [Activate Microsoft Defender XDR Unified RBAC](activate-defender-rbac.md).
+
+### Identity exclusions
+
+| Unified RBAC for identities or endpoints | Required permission |
+| --- | --- |
+| **Disabled** (both identities and endpoints) | Security Administrator or Global Administrator role in [Microsoft Entra ID](https://entra.microsoft.com) or the [Microsoft 365 admin center](https://admin.microsoft.com). |
+| **Enabled** (for identities or endpoints) | Security Operator (or higher) global Microsoft Entra role, **or** the [Core security settings (manage)](custom-permissions-details.md) permission in Unified RBAC. |
+
+> [!NOTE]
+> A Security Reader can view exclusions and tags but can't edit them.
## Exclusion types and approaches
@@ -59,6 +76,8 @@ To exclude a user account from automated responses:
1. Go to **Settings** > **Microsoft Defender XDR**.
+To exclude one or more user accounts from automated responses, follow these steps:
+
1. Under **Automated response**, select **Identities**.
1. Select **Add user exclusion**. A flyout pane appears.
@@ -151,6 +170,8 @@ To create a tag go to Asset rule management in the Microsoft Defender portal and
1. Go to **Settings** > **Microsoft Defender XDR**.
+To exclude IP addresses from automated responses, follow these steps:
+
1. Under **Automated responses**, select **Devices**.
:::image type="content" source="media/automatic-attack-disruption-exclusions/attack-disrupt-devices-tab.png" alt-text="Screenshot of the Devices page in automated response settings for attack disruption" lightbox="media/automatic-attack-disruption-exclusions/attack-disrupt-devices-tab.png":::
@@ -182,7 +203,7 @@ To create a tag go to Asset rule management in the Microsoft Defender portal and
Removing an exclusion allows the asset to be included in automated responses for attack disruption again. When an exclusion is removed, the asset is no longer excluded from automated responses and can be automatically contained if it's involved in an attack that triggers attack disruption.
-To remove an exclusion:
+In the Microsoft Defender portal, go to **Settings** > **Microsoft Defender XDR** > **Automated response**. Then use the appropriate tab to remove an exclusion:
- Go to the **Identities** page. Select the user account you want to remove from the list and then select **Remove**.
@@ -205,7 +226,10 @@ Opting out of attack disruption can greatly increase security risk. Consider [ex
If you must opt out of attack disruption, open a support case in the Microsoft Defender portal with the subject *Attack disruption opt-out*. In your request, specify that you wish to opt out of attack disruption and include a brief explanation about your decision. This feedback helps us improve the feature and better understand customer needs. By opting out, you still receive alerts related to attack disruption but no automated actions are taken.
-## See also
+
+## Related content
+
+For more information about attack disruption, see the following article:
- [View details and results of automated attack disruption actions](autoad-results.md)
diff --git a/defender-xdr/automatic-attack-disruption.md b/defender-xdr/automatic-attack-disruption.md
index 47edc372b04..bf81c0e748d 100644
--- a/defender-xdr/automatic-attack-disruption.md
+++ b/defender-xdr/automatic-attack-disruption.md
@@ -127,7 +127,7 @@ Use the following table to find where each supported identity service is configu
| Identity service | Availability | Configuration and setup |
| --- | --- | --- |
-| Microsoft Entra ID and Active Directory | Generally available | [Configure automatic attack disruption in Microsoft Defender XDR](configure-attack-disruption.md) |
+| Microsoft Entra ID and Active Directory | Generally available | [Configure automatic attack disruption in Microsoft Defender](configure-attack-disruption.md) |
| Okta | Preview | [Enable attack disruption actions in Okta with Microsoft Sentinel](okta-attack-disruption.md) |
| AWS IAM | Preview | [Enable attack disruption actions on AWS with Microsoft Sentinel](/azure/sentinel/aws-disruption?toc=/defender-xdr/toc.json&bc=/defender-xdr/breadcrumb/toc.json) |
diff --git a/defender-xdr/before-you-begin-defender-experts.md b/defender-xdr/before-you-begin-defender-experts.md
deleted file mode 100644
index 4e2477cff8c..00000000000
--- a/defender-xdr/before-you-begin-defender-experts.md
+++ /dev/null
@@ -1,145 +0,0 @@
----
-title: Before you begin using the Microsoft Defender Experts for Hunting service
-ms.reviewer:
-description: Review the prerequisites for Microsoft Defender Experts for Hunting, including required licensing, onboarding, and setup steps before you begin using the service.
-ms.service: defender-experts-for-hunting
-ms.author: pauloliveria
-author: poliveria
-ms.localizationpriority: medium
-ms.collection:
- - m365-security
- - m365initiative-defender-endpoint
- - tier1
- - essentials-compliance
-ms.topic: how-to
-ms.custom:
-- msecd-doc-authoring-1014
-- cx-ti
-- cx-ean
-ms.date: 06/16/2026
-ai-usage: ai-assisted
----
-
-# Before you begin using Defender Experts for Hunting
-
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
-
-**Applies to:**
-
-- [Microsoft Defender XDR](microsoft-365-defender.md)
-
-[Microsoft Defender Experts for Hunting](defender-experts-for-hunting.md) is a managed service that provides hunting capabilities for novel emerging threats that aren't yet well known in the industry. The analysts for the hunting service review trends in the threat actor evolution based on world-renowned Microsoft Threat Intelligence and Research. They then apply the insights they gather to hunt for emerging attack vectors within the customer ecosystem.
-
-With deep product expertise powered by threat intelligence, we're uniquely positioned to help you:
-
-1. Focus on novel threat actor evolution in the context of your ecosystem.
-1. Get detailed, step-by-step, and actionable guidance from our experts so you can respond to these emerging threats.
-1. [Seek assistance](#ask-defender-experts) from Defender Experts.
-
-This document outlines the key infrastructure requirements you must meet and important information on data access and compliance you must know before purchasing the **Microsoft Defender Experts for Hunting - XDR** service and its add-on, **Microsoft Defender Experts for Hunting - Servers**. Microsoft understands that customers who use our managed services entrust us with their most valued asset, their data.
-
-## Eligibility and licensing
-
-Defender Experts for Hunting is a separate service from your existing Microsoft Defender products. Before enrolling in this service, make sure that you have the necessary license and access.
-
-**Microsoft Defender Experts for Hunting – XDR**
-
-We require the following licensing prerequisites to enable us to get started with this threat hunting service:
-
-- Microsoft Defender for Endpoint P2 must be licensed and enabled on eligible devices
-- Microsoft Defender Antivirus must be licensed and enabled in active mode on devices onboarded to Defender for Endpoint (required for endpoint detection)
-
-The following products are also eligible to get Defender Experts for Hunting coverage, and you must have their appropriate product licenses to get started with the service:
-
-- Microsoft Defender for Office 365 P2
-- Microsoft Defender for Identity
-- Microsoft Defender for Cloud Apps
-- Microsoft Entra ID P2
-
-The following product is **not** covered by this service:
-
-- Microsoft Defender for IoT
-- Other Microsoft services not mentioned in the previous lists
-
-**Microsoft Defender Experts for Hunting - Servers**
-
-Customers who wish to have Defender Experts for Hunting coverage for Microsoft Defender for Cloud servers must have the following:
-
-- Defender Experts for Hunting - XDR service enrollment
-- Defender for Servers Plan 1 or Plan 2 in Microsoft Defender for Cloud
-
-> [!NOTE]
-> You can't purchase Defender Experts for Hunting for partial coverage. You must apply it at the tenant level. All identities and devices are automatically included.
-
-### Defender Experts for Hunting coverage
-
-**Microsoft Defender Experts for Hunting – XDR**
-
-Defender Experts for Hunting - XDR relies on event signals from Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, Defender for Identity. It also relies on proprietary Microsoft Threat Intelligence sources.
-
-This service also covers servers that have Defender for Endpoint deployed on them with a **Microsoft Defender for Endpoint for Servers** license.
-
-Any detection that's not from Microsoft Defender products (for example, detections from other security vendors) isn't within the scope of Defender Experts for Hunting.
-
-**Microsoft Defender Experts for Hunting - Servers**
-
-Defender Experts for Hunting – Servers provides add-on server coverage, including hybrid and multicloud servers from Defender for Servers.
-
-### Ask Defender Experts
-
-[Ask Defender Experts](experts-on-demand.md) is intended to provide a better understanding of complex threats affecting your organization. It focuses on products included in Microsoft Defender Experts services. [See sample questions you can ask Defender Experts](experts-on-demand.md#sample-questions-you-can-ask-from-defender-experts).
-
-Defender Experts for Hunting customers are assigned 10 Ask Defender Experts credits, which you can use to submit questions, at the start of each calendar quarter. Unused credits from the current quarter roll up to the next one. You can use up to 20 credits only per quarter. All unused credits expire by the end of the calendar year or at the end of your subscription term, whichever comes first.
-
-[Learn more about Microsoft's commercial licensing terms](https://www.microsoft.com/licensing/terms/productoffering/Microsoft365/MCA)
-
-## Access requirements
-
-Anyone from your organization can [apply for the Defender Experts for Hunting service](#apply-for-microsoft-defender-experts-for-hunting-service). However, you need to work with your Commercial Executive to transact the SKU.
-
-You might need certain roles and permissions to fully access the service capabilities. Refer to [Custom roles in role-based access control for Microsoft Defender XDR](custom-roles.md) for details.
-
-## Service availability and data protection
-
-Defender Experts for Hunting - XDR and Defender Experts for Hunting - Servers are managed threat hunting services that proactively hunt for threats across endpoints, email, identity, cloud apps, and servers. To carry out hunting on your behalf, Microsoft experts need access to your Microsoft Defender XDR advanced hunting data. Enrolling in this service means you're granting permission to Microsoft experts to access the said data.
-
-The following sections enumerate additional information about the service's data usage, compliance, and availability. For more information about Microsoft's commitment in valuing and protecting your data, visit the [Trust Center](https://www.microsoft.com/trust-center/product-overview) then scroll down to **Additional products and services** > **Managed Security Services** > **Microsoft Defender Experts**.
-
-### Data collection, usage, and retention
-
-All data used for hunting from existing Defender services will continue to reside in the customer's original Microsoft Defender XDR service storage location. [Learn more about Microsoft 365 data locations](/microsoft-365/enterprise/o365-data-locations)
-
-Defender Experts for Hunting operational data, such as case tickets and analyst notes, are generated and stored in a Microsoft data center in the EU region for customers whose Defender XDR data is in scope of European Union data boundary and in the US region for other customers, for the length of the service, irrespective of the Microsoft Defender XDR service storage location. Data generated for the reporting dashboard is stored in customer's Microsoft Defender XDR service storage location. Reporting data and operational data will be retained for a grace period of no more than 90 days after a customer's subscription expires. If the customer terminates their subscription, data will be deleted within 30 days.
-
-Microsoft experts hunt over [advanced hunting logs](advanced-hunting-schema-tables.md) in Microsoft Defender XDR advanced hunting tables. The data in these tables depend on the set of Defender services the customer is enabled for (for example, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Microsoft Entra ID). Experts also use a large set of internal threat intelligence data to inform their hunting and automation.
-
-> [!NOTE]
-> Microsoft Defender for Cloud is integrated with Microsoft Defender XDR. This integration allows security teams to access Defender for Cloud alerts and incidents within the Microsoft Defender portal. The Defender Experts for Hunting - Servers add-on service accesses data through the Defender portal, so the same data collection, usage, and retention policies apply to this service.
-
-### Security and compliance
-
-When you purchase and onboard to Defender Experts for Hunting, you're granting permission to Microsoft experts to access your advanced hunting data.
-
-### Availability
-
-This service is available worldwide for customers in our commercial public clouds. It's currently not available to customers in government and sovereign clouds.
-
-### Languages
-
-This service is currently delivered in English language only.
-
-## Apply for Microsoft Defender Experts for Hunting service
-
-You can apply for the Defender Experts for Hunting by performing the following steps:
-
-1. Complete the [customer interest form](https://aka.ms/DEX4HuntingCustomerInterestForm).
-2. Enter your name, company name, and company email ID.
-3. Select **Submit**. Someone from our sales team will reach out within five business days.
-
-### Next step
-
-Continue to the following article to start using Defender Experts for Hunting:
-
-- [Start using Defender Experts for Hunting](onboarding-defender-experts-for-hunting.md)
-
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/before-you-begin-xdr.md b/defender-xdr/before-you-begin-xdr.md
deleted file mode 100644
index 20374373a63..00000000000
--- a/defender-xdr/before-you-begin-xdr.md
+++ /dev/null
@@ -1,121 +0,0 @@
----
-title: Before you begin using the Microsoft Defender Experts for XDR service
-ms.reviewer:
-description: To enable us to get started with the defender experts managed service, we require the following licensing prerequisites
-ms.service: defender-experts-for-xdr
-ms.author: pauloliveria
-author: poliveria
-ms.localizationpriority: medium
-ms.collection:
- - m365-security
- - tier1
- - essentials-compliance
-ms.topic: concept-article
-ms.custom:
-- cx-ti
-- cx-dex
-ms.date: 05/18/2026
----
-
-# Before you begin using Defender Experts for XDR
-
-**Applies to:**
-
-- [Microsoft Defender Experts for XDR](dex-xdr-overview.md)
-
-This article outlines the key prerequisites you must meet and essential information you must know before purchasing the Microsoft Defender Experts for XDR and Microsoft Defender Experts for Servers services.
-
-## Licensing and service onboarding prerequisites
-
-Defender Experts for XDR is a separate service from your existing Defender products. To be eligible for Defender Experts and to enable us to get started with this managed service, see the service requirements at [Microsoft Product Terms](https://www.microsoft.com/licensing/terms/productoffering/MicrosoftDefenderExperts/EAEAS).
-
-### Service coverage prerequisites
-
-Defender Experts for XDR provides managed detection and response across any combination of the following Microsoft Defender products:
-
-- Microsoft Defender for Endpoint P2
-- Microsoft Defender for Office 365 P2
-- Microsoft Defender for Identity
-- Microsoft Defender for Cloud Apps
-- Microsoft Entra ID P2
-
-You must license and deploy at least one of the listed Microsoft Defender products, or Microsoft Entra ID P2, in active mode to receive Defender Experts coverage.
-
-While Microsoft Entra ID P1 is a requirement for service eligibility, to provide identity-based service coverage, Microsoft Entra ID P2 is required. Entra ID P2 provides advanced identity protection capabilities and additional identity telemetry that Defender Experts relies on to detect and respond to identity-based threats.
-
-The following product isn't covered by this service:
-
-- Microsoft Defender for IoT
-
-### Prerequisites to begin operations
-
-To begin service operations, you must license and deploy at least one of these products in active mode. Even if you don't configure some products, such as Defender for Endpoint, in active mode, Defender Experts can still provide coverage for the other eligible products in your environment. However, the depth of response might vary. For more information, see [Product configuration and service coverage](#product-configuration-and-service-coverage).
-
-### Product configuration and service coverage
-
-**Microsoft Defender Experts for XDR**
-
-Defender Experts for XDR provides managed detection and response across Microsoft Defender products that you license and properly deploy in your environment.
-While you can include all Defender products (except Defender for IoT) in the service, the depth of coverage might vary depending on how you configure each product.
-- **Products deployed in active mode are fully covered.** Defender Experts investigate and respond to incidents involved in these products on your behalf.
-- **Products deployed in passive mode might be non-actionable by Defender Experts.** In such cases, guided response might still be provided, but no remediation actions are taken on your behalf.
-
-Ensure that you deploy at least one product, such as Defender for Endpoint or Defender for Office 365, in active mode. This deployment enables Defender Experts to take direct action on high-priority threats, including advanced attacks like adversary-in-the-middle (AiTM).
-
-For maximum, native coverage, deploy the full Microsoft Defender XDR suite and enable all eligible products in active mode.
-
-Defender Experts for XDR also covers servers that have Defender for Endpoint deployed on them with a **Microsoft Defender for Endpoint for Server** license. For Defender Experts coverage, a server counts as a user account for billing.
-[Learn more about specific hardware and software requirements](/defender-endpoint/minimum-requirements)
-
-### Ask Defender Experts
-
-[Ask Defender Experts](experts-on-demand.md) is intended to provide a better understanding of complex threats affecting your organization. It focuses on products included in Microsoft Defender Experts services. [See sample questions you can ask Defender Experts](experts-on-demand.md#sample-questions-you-can-ask-from-defender-experts).
-
-As part of the service's built-in [Microsoft Defender Experts for Hunting](defender-experts-for-hunting.md), customers are assigned 10 **Ask Defender Experts** credits, which you can use to submit questions, at the start of each calendar quarter. Unused credits from the current quarter roll up to the next one. You can use up to 20 credits only per quarter. All unused credits expire by the end of the calendar year or at the end of your subscription term, whichever comes first.
-
-[Learn more about Microsoft's commercial licensing terms](https://www.microsoft.com/licensing/terms/productoffering/Microsoft365/MCA).
-
-## Access requirements
-
-Work with your Commercial Executive to transact the Defender Experts for XDR and Defender Experts for Servers SKUs.
-
-Defender Experts for XDR and Defender Experts for Servers request for certain roles and permissions for you to fully access the service capabilities. [Learn more](dex-xdr-permissions.md)
-
-## Service availability and data protection
-
-Defender Experts for XDR and Defender Experts for Servers are managed extended detection and response services that proactively hunt for threats across endpoints, email, identity, cloud apps, and servers. To carry out hunting on your behalf, Microsoft experts need access to your Microsoft Defender XDR advanced hunting data. If you have the Defender Experts for Servers add-on service, they need to review [Microsoft Defender for Cloud alerts and incidents in Defender XDR](/azure/defender-for-cloud/concept-integration-365). By purchasing these services, you grant Microsoft experts permission to access this data.
-
-The following sections provide additional information about the service's data usage, compliance, and availability. For more information about Microsoft's commitment to valuing and protecting your data, visit the [Trust Center](https://www.microsoft.com/en-us/trust-center/product-overview) and scroll down to **Additional products and services** > **Managed Security Services** > **Microsoft Defender Experts**.
-
-### Data collection, usage, and retention
-
-All data used for hunting from existing Defender services stays in your original Microsoft Defender XDR service storage location. [Learn more](/microsoft-365/enterprise/o365-data-locations).
-
-Defender Experts for XDR operational data, such as case tickets and analyst notes, are generated and stored in a Microsoft data center in the European Union region for customers whose Defender XDR data is in scope of EU data boundary and in the US region for other customers, irrespective of the Microsoft Defender XDR service storage location. Data generated for the reporting dashboard is stored in your Microsoft Defender XDR service storage location. Reporting data and operational data are retained for a grace period of no more than 90 days after your subscription expires. If you terminate your subscription, data is deleted within 30 days.
-
-Microsoft experts hunt over [advanced hunting logs](advanced-hunting-schema-tables.md) in Microsoft Defender XDR advanced hunting tables. The data in these tables depend on the set of Defender services you enable (for example, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Microsoft Entra ID). Experts also use a large set of internal threat intelligence data to inform their hunting and automation.
-
-> [!NOTE]
-> Microsoft Defender for Cloud is integrated with Microsoft Defender XDR. This integration allows security teams to access Defender for Cloud alerts and incidents within the Microsoft Defender portal. The Defender Experts for Servers service accesses data through the Defender portal, so the same data collection, usage, and retention policies apply to this service.
-
-### Security and compliance
-
-When you purchase and onboard to Defender Experts for XDR and Defender Experts for Servers, you grant Microsoft experts permission to access your advanced hunting data.
-
-### Availability
-
-Customers can access this service worldwide in commercial public clouds. To learn more, contact your Microsoft account team.
-
-### Language
-
-This service is currently available only in English.
-
-### Next step
-
-- [Get started with Microsoft Defender Experts for XDR](get-started-xdr.md)
-
-### See also
-
-- [General information on Defender Experts for XDR service](frequently-asked-questions.md)
-
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/compare-rbac-roles.md b/defender-xdr/compare-rbac-roles.md
index 1783189d3dc..e5e28a8b530 100644
--- a/defender-xdr/compare-rbac-roles.md
+++ b/defender-xdr/compare-rbac-roles.md
@@ -140,7 +140,7 @@ Use the following table to learn how your existing permissions for Microsoft Def
>
> - Virtually all app governance experiences are controlled by Microsoft Entra ID roles **only**. The only exception is the [OAuthAppInfo table in advanced hunting](advanced-hunting-oauthappinfo-table.md). Unified RBAC permissions in Defender for Cloud Apps grant access to the app governance data in this specific table.
>
-> - In the [unified alerts and incidents experiences in Defender XDR](investigate-alerts.md), access to app governance data is controlled by Microsoft Entra ID **only**.
+> - In the [unified alerts and incidents experiences in Defender](investigate-alerts.md), access to app governance data is controlled by Microsoft Entra ID **only**.
>
> For more information about permissions in app governance, see [App governance roles](/defender-cloud-apps/app-governance-get-started#roles).
>
@@ -193,7 +193,7 @@ The following roles aren't available in unified RBAC and must be managed in the
### Sample permission mappings of Microsoft Sentinel built-in roles to Microsoft Defender unified RBAC roles
-These are examples of the permissions that can be assigned to the users based on their roles in Microsoft Sentinel. As unified RBAC provides the option to have more granular permissions on Microsoft Defender XDR, you can utilize that granularity to separate certain Microsoft Defender XDR permissions on Tier level as well. For example, you can apply Live Response Basic to Tier 1, but Live Response Advanced permission to Tier 2.
+These are examples of the permissions that can be assigned to the users based on their roles in Microsoft Sentinel XDR. As unified RBAC provides the option to have more granular permissions on Microsoft Defender XDR, you can utilize that granularity to separate certain Microsoft Defender permissions on Tier level as well. For example, you can apply Live Response Basic to Tier 1, but Live Response Advanced permission to Tier 2.
If some users need only read access to Microsoft Sentinel SIEM raw data, they can also utilize Log Analytics [Granular RBAC](/azure/azure-monitor/logs/granular-rbac-log-analytics) functionality to scope access to only specific data saved in Log Analytics workspace. Please note that Granular RBAC will not scope access to Microsoft Sentinel incidents, alerts, watchlists, UEBA, TI, or any other Microsoft Sentinel SIEM features.
@@ -201,14 +201,14 @@ If some users need only read access to Microsoft Sentinel SIEM raw data, they ca
|---|---|---|---|
| Security Analysts | Microsoft Sentinel Responder | Microsoft Sentinel's Resource Group | View data, incidents, workbooks, and other Microsoft Sentinel resources. Manage incidents (assign, dismiss, etc.) |
| Security Analysts | Microsoft Sentinel Playbook Operator | Microsoft Sentinel's Resource Group (or the Resource Group where Playbooks are stored) | List, view and run playbooks. To attach playbooks to analytics rules, Microsoft Sentinel Contributor role is needed |
-| Security Analysts | Security Operator Unified RBAC role | Microsoft Defender portal | View, investigate, and respond to security threats alerts
Manage Microsoft Defender XDR security settings
List of URBAC permissions equivalent for Security Operator Entra ID role are listed on this link:
/defender-xdr/compare-rbac-roles#microsoft-entra-global-roles-access |
+| Security Analysts | Security Operator Unified RBAC role | Microsoft Defender portal | View, investigate, and respond to security threats alerts
Manage Microsoft Defender security settings
List of URBAC permissions equivalent for Security Operator Entra ID role are listed on this link:
/defender-xdr/compare-rbac-roles#microsoft-entra-global-roles-access |
| Security Engineer | Microsoft Sentinel Contributor | Microsoft Sentinel's Resource Group | View data, incidents, workbooks, and other Microsoft Sentinel resources. Manage incidents (assign, dismiss, etc.). Create and edit workbooks, analytics rules, and other Microsoft Sentinel resources. |
| Security Engineer | Logic Apps Contributor | Microsoft Sentinel's Resource Group (or the Resource Group where Playbooks are stored) | Run and modify playbooks.
Attach playbooks to analytics rules and automation rules. |
| Security Engineer | Monitoring Contributor | Subscription and/or Resource group and/or An existing data collection rule | Create or edit data collection rules |
| Security Engineer | Log Analytics Contributor | Microsoft Sentinel's Resource Group | Use the Search feature |
| Security Engineer | Virtual Machine Contributor Azure Connected Machine Resource Administrator | Virtual machines, virtual machine scale sets Arc-enabled servers | Deploy DCR associations (i.e. to assign rules to the machine) |
| Security Engineer | Template Spec Contributor | Microsoft Sentinel's Resource Group | Deploy v2.0 solutions from Content hub. |
-| Security Engineer | Security Administrator Unified RBAC role | Microsoft Defender portal | Monitor security-related policies across Microsoft Defender XDR services
Manage security threats and alerts
View reports
List of URBAC permissions equivalent for Security Administrator Entra ID role are listed on this link:
/defender-xdr/compare-rbac-roles#microsoft-entra-global-roles-access |
+| Security Engineer | Security Administrator Unified RBAC role | Microsoft Defender portal | Monitor security-related policies across Microsoft Defender services
Manage security threats and alerts
View reports
List of URBAC permissions equivalent for Security Administrator Entra ID role are listed on this link:
/defender-xdr/compare-rbac-roles#microsoft-entra-global-roles-access |
| Security Architect | Microsoft Sentinel Contributor | Microsoft Sentinel's Resource Group | View data, incidents, workbooks, and other Microsoft Sentinel resources. Manage incidents (assign, dismiss, etc.). Create and edit workbooks, analytics rules, and other Microsoft Sentinel resources. |
| Security Architect | User Access Administrator | Microsoft Sentinel's Resource Group | This is privileged role! This permission is needed to onboard Microsoft Sentinel SIEM to Microsoft Defender portal. |
| Security Architect | Security Administrator | Entara ID Tenant level | This is a privileged role! Users with this role have permissions to manage security-related features in the Microsoft 365 Defender portal, Microsoft Entra ID Protection, Microsoft Entra Authentication, Azure Information Protection, and Microsoft Purview compliance portal.
This permission is needed to onboard Microsoft Sentinel SIEM to Microsoft Defender portal, offboard the workspace, or change primary/secondary workspace. |
diff --git a/defender-xdr/configure-asset-rules.md b/defender-xdr/configure-asset-rules.md
index d9e4a6975be..e47e8fb181c 100644
--- a/defender-xdr/configure-asset-rules.md
+++ b/defender-xdr/configure-asset-rules.md
@@ -9,12 +9,14 @@ ms.collection:
- m365-security
- tier2
ms.topic: how-to
-ms.date: 02/19/2025
+ms.date: 06/15/2026
appliesto:
- Microsoft Defender XDR
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender for Business
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1014
#customer intent: As a security administrator, I want to create dynamic rules for devices in asset rule management so that I can automatically assign tags and device values based on certain criteria.
---
@@ -58,9 +60,10 @@ The following steps guide you on how to create a new dynamic rule in Microsoft D
>[!NOTE]
> It may take up to 1 hour for changes to be reflected in the portal.
-### Dynamic tags in the Device Inventory
+
+### View dynamic tags in Device Inventory
-You can see the dynamic tags assigned in the Device Inventory view.
+You can see the dynamic tags assigned on the **Device Inventory** page in the Microsoft Defender portal.
> [!NOTE]
> Dynamic tags are not supported by [security baseline assessments](/defender-vulnerability-management/tvm-security-baselines).
@@ -75,8 +78,9 @@ To see tags on individual devices:
:::image type="content" source="media/configure-asset-rules/manage-machine-tags.png" alt-text="Screenshot of the machine tags page" lightbox="media/configure-asset-rules/manage-machine-tags.png":::
-### Updating rules
+
+### Update an existing dynamic rule
-Dynamic tags and device values set by dynamic rules can't be manually updated. To edit, delete or turn off a rule, in the **Asset Rule Management** page select the rule and choose an action.
+Dynamic tags and device values set by dynamic rules can't be manually updated. To edit, delete, or turn off a rule, on the **Asset Rule Management** page, select the rule and then select **Edit**, **Delete**, or **Turn off**.
:::image type="content" source="media/configure-asset-rules/update-rule.png" alt-text="Screenshot of the rule details page" lightbox="media/configure-asset-rules/update-rule.png":::
diff --git a/defender-xdr/configure-attack-disruption.md b/defender-xdr/configure-attack-disruption.md
index d13b0c54f78..a3478ddb870 100644
--- a/defender-xdr/configure-attack-disruption.md
+++ b/defender-xdr/configure-attack-disruption.md
@@ -6,11 +6,12 @@ author: guywi-ms
ms.topic: how-to
ms.service: defender-xdr
ms.localizationpriority: medium
-ms.date: 05/31/2026
+ms.date: 06/15/2026
ms.collection:
- m365-security
- tier2
ms.custom:
+ - msecd-doc-authoring-1014
- autoir
- admindeeplinkDEFENDER
- sfi-ga-nochange
@@ -26,20 +27,22 @@ ai-usage: ai-assisted
Microsoft Defender XDR includes powerful [automated attack disruption](automatic-attack-disruption.md) capabilities that can protect your environment from sophisticated, high-impact attacks.
-Configure automatic attack disruption capabilities in Microsoft Defender XDR. After you're all set up, you can view and manage containment actions in Incidents and the Action center. And, if necessary, you can make changes to settings.
+Configure automatic attack disruption capabilities in Microsoft Defender XDR. After you're all set up, you can view and manage containment actions in Incidents and the Action center. And, if necessary, you can make changes to automatic attack disruption settings.
## Prerequisites
-The following are prerequisites for configuring automatic attack disruption in Microsoft Defender XDR:
+The following are prerequisites for configuring automatic attack disruption in Microsoft Defender:
|Requirement|Details|
|---|---|
|Subscription requirements|One of these subscriptions: - Microsoft 365 E5 or A5
- Microsoft 365 E3 with the Microsoft Defender Suite add-on
- Microsoft 365 E3 with the Enterprise Mobility + Security E5 add-on
- Microsoft 365 A3 with the Microsoft 365 A5 Security add-on
- Windows 10 Enterprise E5 or A5
- Windows 11 Enterprise E5 or A5
- Enterprise Mobility + Security (EMS) E5 or A5
- Office 365 E5 or A5
- Microsoft Defender for Endpoint (Plan 2)
- Microsoft Defender for Identity
- Microsoft Defender for Cloud Apps
- Defender for Office 365 (Plan 2)
- Microsoft Defender for Business
See [Microsoft Defender XDR licensing requirements](./prerequisites.md#licensing-requirements).|
-|Deployment requirements|
- Deployment of Defender products (for example, Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps)
- The wider the deployment, the greater the protection coverage is. For example, if a Microsoft Defender for Cloud Apps signal is used in a certain detection, then this product is required to detect the relevant specific attack scenario.
- Similarly, the relevant product should be deployed to execute an automated response action. For example, Microsoft Defender for Endpoint is required to automatically contain a device.
- Microsoft Defender for Endpoint's device discovery is set to 'standard discovery' (prerequisite for the automatic initiation of the "Contain Device" action)
- For attack disruption actions in [external platforms](#microsoft-sentinel-prerequisites-for-external-platforms-preview) such as Okta or AWS (preview): Microsoft Sentinel analytic workspace connected to the unified security operations portal with the relevant provider connector deployed.
|
+|Deployment requirements|- Deployment of Defender products (for example, Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps)
- The wider the deployment, the greater the protection coverage is. For example, if a Microsoft Defender for Cloud Apps signal is used in a certain detection, then this product is required to detect the relevant specific attack scenario.
- Similarly, each Defender product must be deployed to execute its automated response actions. For example, Microsoft Defender for Endpoint is required to automatically contain a device.
- Microsoft Defender for Endpoint's device discovery is set to 'standard discovery' (prerequisite for the automatic initiation of the "Contain Device" action)
- For attack disruption actions in [external platforms](#microsoft-sentinel-prerequisites-for-external-platforms-preview) such as Okta or AWS (preview): Microsoft Sentinel analytic workspace connected to the unified security operations portal with the relevant provider connector deployed.
|
|Permissions|To configure automatic attack disruption capabilities, you must have one of the following roles assigned in either Microsoft Entra ID () or in the Microsoft 365 admin center (): - Global Administrator
- Security Administrator
- User Administrator
- Authentication Administrator
- Privileged Authentication Administrator
- Directory Writers
- Helpdesk Administrator
- Security Operator
To work with automated investigation and response capabilities, such as by reviewing, approving, or rejecting pending actions, see [Required permissions for Action center tasks](m365d-action-center.md#required-permissions-for-action-center-tasks).|
### Microsoft Defender for Endpoint prerequisites
+To support automatic attack disruption, Microsoft Defender for Endpoint requires a minimum Sense client version and proper automation settings for your device groups.
+
#### Minimum Sense Client version (MDE client)
The Minimum Sense Agent version required for the **Contain User** action to work is v10.8470. You can identify the Sense Agent version on a device by running the following PowerShell command:
@@ -58,7 +61,7 @@ Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
Review the automation settings for your device group policies to determine whether automated investigations run and whether remediation actions are taken automatically or only after approval. You must be a global administrator or security administrator to perform the following procedure:
-1. Go to the Microsoft Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in.
+1. Go to the [Microsoft Defender portal](https://security.microsoft.com) and sign in.
2. Go to **System** \> **Settings** \> **Endpoints** \> **Device groups** under **Permissions**.
@@ -67,17 +70,19 @@ Review the automation settings for your device group policies to determine wheth
You can also create or edit your device groups to set the appropriate remediation level for each group. Selecting the **Semi automation** level allows triggering of automatic attack disruption without the need for manual approval. To exclude a device group from automated containment, you can set its automation level to **no automated response**. This setting isn't highly recommended and should only be done for a limited number of devices.
> [!NOTE]
-> Attack disruption can act on devices independent of a device's Microsoft Defender Antivirus operating state. The operating state can be in Active, Passive, or EDR Block Mode.
+> Attack disruption can act on devices independent of a device's Microsoft Defender Antivirus operating state. The Microsoft Defender Antivirus operating state can be Active, Passive, or EDR Block Mode.
### Microsoft Defender for Identity prerequisites
+To support automatic attack disruption, Microsoft Defender for Identity requires domain controller auditing and properly configured action accounts.
+
#### Set up auditing in domain controllers
To set up auditing on domain controllers, see [Configure audit policies for Windows event logs](/defender-for-identity/deploy/configure-windows-event-collection). Ensure required audit events are configured on domain controllers where the Defender for Identity sensor is deployed.
#### Validate action accounts
-Defender for Identity allows you to take remediation actions targeting on-premises Active Directory accounts when an identity is compromised. To take these actions, Defender for Identity needs to have the required permissions to do so. By default, the Defender for Identity sensor impersonates the LocalSystem account of the domain controller and performs the actions. Since the default can be changed, validate that Defender for Identity has the required permissions or uses the default LocalSystem account.
+Defender for Identity allows you to take remediation actions targeting on-premises Active Directory accounts when an identity is compromised. To take these actions, Defender for Identity needs to have the required permissions to do so. By default, the Defender for Identity sensor impersonates the LocalSystem account of the domain controller and performs the actions. Since this default LocalSystem account impersonation can be changed, validate that Defender for Identity has the required permissions or uses the default LocalSystem account.
You can find more information on the action accounts in [Configure Microsoft Defender for Identity action accounts](/defender-for-identity/deploy/manage-action-accounts).
@@ -88,6 +93,8 @@ The Defender for Identity sensor needs to be deployed on the domain controller w
### Microsoft Defender for Cloud Apps prerequisites
+To support automatic attack disruption, Microsoft Defender for Cloud Apps requires a properly configured Microsoft Office 365 connector.
+
#### Microsoft Office 365 connector
Microsoft Defender for Cloud Apps must be connected to Microsoft Office 365 through the connector. To connect Defender for Cloud Apps, see [Connect Microsoft 365 to Microsoft Defender for Cloud Apps](/defender-cloud-apps/protect-office-365#connect-microsoft-365-to-microsoft-defender-for-cloud-apps).
@@ -101,19 +108,15 @@ Microsoft Defender for Cloud Apps must be connected to Microsoft Office 365 thro
### Microsoft Defender for Office 365 prerequisites
+To support automatic attack disruption, Microsoft Defender for Office 365 requires mailboxes hosted in Exchange Online and specific mailbox audit logging events.
+
#### Mailboxes location
Mailboxes are required to be hosted in Exchange Online.
#### Mailbox audit logging
-The following mailbox events need to be audited by minimum:
-
-- MailItemsAccessed
-- UpdateInboxRules
-- MoveToDeletedItems
-- SoftDelete
-- HardDelete
+At minimum, audit these mailbox events: MailItemsAccessed, UpdateInboxRules, MoveToDeletedItems, SoftDelete, and HardDelete.
Review [manage mailbox auditing](/purview/audit-mailboxes) to learn about managing mailbox auditing.
diff --git a/defender-xdr/configure-email-notifications.md b/defender-xdr/configure-email-notifications.md
index 00f5d931b5d..e4952a1d4c2 100644
--- a/defender-xdr/configure-email-notifications.md
+++ b/defender-xdr/configure-email-notifications.md
@@ -9,13 +9,14 @@ ms.collection:
- m365-security
- tier2
ms.topic: how-to
-ms.date: 01/17/2025
+ms.date: 06/15/2026
appliesto:
- Microsoft Defender XDR
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender for Business
-ms.custom: sfi-ga-nochange
+ms.custom: sfi-ga-nochange, msecd-doc-authoring-1014
+ai-usage: ai-assisted
---
# Configure alert notifications
@@ -72,6 +73,8 @@ You can create rules that determine the devices and alert severities to send ema
## Edit a notification rule
+To edit an existing notification rule, follow these steps:
+
1. Select the notification rule you'd like to edit.
2. Update the General and Recipient tab information.
@@ -80,13 +83,15 @@ You can create rules that determine the devices and alert severities to send ema
## Delete notification rule
+To delete a notification rule, follow these steps:
+
1. Select the notification rule you'd like to delete.
2. Click **Delete**.
## Troubleshoot email notifications for alerts
-This section lists various issues that you may encounter when using email notifications for alerts.
+The following troubleshooting information covers issues you might encounter when using email notifications for alerts.
**Problem:** Intended recipients report they're not getting the notifications.
@@ -96,7 +101,8 @@ This section lists various issues that you may encounter when using email notifi
2. Check that your email security product isn't blocking the email notifications.
3. Check your email application rules that might be catching and moving your email notifications.
-## Related topics
+
+## Related content
- [Update data retention settings](/defender-endpoint/preferences-setup)
- [Configure advanced features](/defender-endpoint/advanced-features)
diff --git a/defender-xdr/configure-event-hub.md b/defender-xdr/configure-event-hub.md
index 4367043d50f..2b22e08ab1c 100644
--- a/defender-xdr/configure-event-hub.md
+++ b/defender-xdr/configure-event-hub.md
@@ -102,7 +102,7 @@ You can create Event Hubs within your Namespace and **all** the Event Types (Tab
Instead of exporting all the Event Types (Tables) into one Event Hub, you can export each table into different Event Hubs inside your Event Hubs Namespace (one Event Hub per Event Type).
-In this option, Microsoft Defender XDR creates Event Hubs for you.
+In this option, Microsoft Defender creates Event Hubs for you.
> [!NOTE]
> If you are using an Event Hub Namespace that is **not** part of an Event Hub Cluster, you're only able to choose up to 10 Event Types (Tables) to export in each Export Settings you define, due to an Azure limitation of 10 Event Hub per Event Hub Namespace.
@@ -125,7 +125,7 @@ For these Event Hubs (not namespace), you need to configure a Shared Access Poli
-## Configure Microsoft Defender XDR to send email tables
+## Configure Microsoft Defender to send email tables
diff --git a/defender-xdr/configure-siem-defender.md b/defender-xdr/configure-siem-defender.md
index 06948a54a9e..08b125cdb24 100644
--- a/defender-xdr/configure-siem-defender.md
+++ b/defender-xdr/configure-siem-defender.md
@@ -23,19 +23,19 @@ ms.custom: msecd-doc-authoring-1014
-## Pull Microsoft Defender XDR incidents and streaming event data using security information and events management (SIEM) tools
+## Pull Microsoft Defender incidents and streaming event data using security information and events management (SIEM) tools
> [!NOTE]
>
-> - [Microsoft Defender XDR Incidents](incident-queue.md) consists of collections of correlated alerts and their evidence.
-> - [Microsoft Defender XDR Streaming API](streaming-api.md) streams event data from Microsoft Defender XDR to event hubs or Azure storage accounts.
+> - [Microsoft Defender Incidents](incident-queue.md) consists of collections of correlated alerts and their evidence.
+> - [Microsoft Defender Streaming API](streaming-api.md) streams event data from Microsoft Defender to event hubs or Azure storage accounts.
-Microsoft Defender XDR supports security information and event management (SIEM) tools ingesting information from your enterprise tenant in Microsoft Entra ID using the OAuth 2.0 authentication protocol for a registered Microsoft Entra application representing the specific SIEM solution or connector installed in your environment.
+Microsoft Defender supports security information and event management (SIEM) tools ingesting information from your enterprise tenant in Microsoft Entra ID using the OAuth 2.0 authentication protocol for a registered Microsoft Entra application representing the specific SIEM solution or connector installed in your environment.
For more information, see:
-- [Microsoft Defender XDR APIs license and terms of use](/legal/microsoft-365/api-terms)
-- [Access the Microsoft Defender XDR APIs](api-access.md)
+- [Microsoft Defender APIs license and terms of use](/legal/microsoft-365/api-terms)
+- [Access the Microsoft Defender APIs](api-access.md)
- [Hello World example](api-hello-world.md)
- [Get access with application context](api-create-app-web.md)
@@ -45,7 +45,7 @@ There are two primary models to ingest security information:
2. Ingesting streaming event data either through Azure Event Hubs or Azure Storage Accounts.
-Microsoft Defender XDR currently supports the following SIEM solution integrations:
+Microsoft Defender currently supports the following SIEM solution integrations:
- [Ingesting incidents from the incidents REST API](#ingesting-incidents-from-the-incidents-rest-api)
- [Ingesting streaming event data via Event Hubs](#ingesting-streaming-event-data-via-event-hubs)
@@ -56,7 +56,7 @@ The following SIEM solutions support ingesting Microsoft Defender XDR incidents
### Incident schema
-For more information on Microsoft Defender XDR incident properties including contained alert and evidence entities metadata, see [Schema mapping](api-list-incidents.md#schema-mapping).
+For more information on Microsoft Defender incident properties including contained alert and evidence entities metadata, see [Schema mapping](api-list-incidents.md#schema-mapping).
### Ingest incidents into Splunk
@@ -65,14 +65,14 @@ Using the new, fully supported Splunk Add-on for Microsoft Security that support
- Ingesting incidents that contain alerts from the following products, which are mapped onto Splunk's Common Information Model (CIM):
- - Microsoft Defender XDR
+ - Microsoft Defender
- Microsoft Defender for Endpoint
- Microsoft Defender for Identity and Microsoft Entra ID Protection
- Microsoft Defender for Cloud Apps
- Ingesting Defender for Endpoint alerts (from the Defender for Endpoint's Azure endpoint) and updating these alerts
-- Support for updating Microsoft Defender XDR Incidents and/or Microsoft Defender for Endpoint Alerts and the respective dashboards has moved to the Microsoft 365 App for Splunk.
+- Support for updating Microsoft Defender Incidents and/or Microsoft Defender for Endpoint Alerts and the respective dashboards has moved to the Microsoft 365 App for Splunk.
For more information on:
@@ -115,7 +115,7 @@ For more information on the Splunk Add-on for Microsoft Cloud Services, see the
### Stream event data to IBM QRadar
-Use the new IBM QRadar Microsoft Defender XDR Device Support Module (DSM), which calls the [Microsoft Defender XDR Streaming API](streaming-api.md). The Streaming API allows you to ingest streaming event data from Microsoft Defender XDR products via Event Hubs or Azure Storage Account. For more information on supported event types, see [Supported event types](supported-event-types.md).
+Use the new IBM QRadar Microsoft Defender XDR Device Support Module (DSM) that calls the [Microsoft Defender Streaming API](streaming-api.md) that allows ingesting streaming event data from Microsoft Defender products via Event Hubs or Azure Storage Account. For more information on supported event types, see [Supported event types](supported-event-types.md).
### Stream event data to Elastic
diff --git a/defender-xdr/contact-defender-support.md b/defender-xdr/contact-defender-support.md
index 4be60e06cf3..403a6607f59 100644
--- a/defender-xdr/contact-defender-support.md
+++ b/defender-xdr/contact-defender-support.md
@@ -2,14 +2,16 @@
title: Contact Microsoft Defender support
description: Learn how to contact Microsoft Defender support via the Defender portal.
ms.topic: how-to
-ms.date: 10/20/2025
+ms.date: 06/15/2026
ms.service: defender-xdr
ms.author: guywild
author: guywi-ms
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1014
---
# Contact Microsoft Defender support
-Microsoft Defender support process is designed to help you find solutions to common problems and submit support cases to the Microsoft support team.
+Microsoft Defender support process is designed to help you find solutions to common problems and submit support cases to the Microsoft support team. This article explains how to access the support widget in the Defender portal, review suggested self-help articles, and open a service request when you need direct assistance.
## Prerequisites
@@ -26,6 +28,7 @@ You must meet the following requirements before you can open a support case:
## Access the widget
+To open the support widget in the Defender portal, follow these steps:
1. Select the question mark on the top right of the Defender portal page
@@ -44,7 +47,7 @@ You must meet the following requirements before you can open a support case:
## View insights and suggested support articles
-This option includes articles that might be related to the question you might ask. Just start typing the question in the search box and articles related to your search show up.
+This section shows articles related to your question. Type your question in the search box to find matching articles.
:::image type="content" source="media/contact-defender-support/answer-to-support-question.png" alt-text="Screenshot that shows the auto generated answer for the relevant support question that was asked." lightbox="media/contact-defender-support/answer-to-support-question.png":::
@@ -52,7 +55,7 @@ In case the suggested articles aren't sufficient, you can open a service request
## Submit a support request
-To open a service request, select the **Contact support**. This opens a form where you can provide details about the issue you're facing.
+To open a service request, select the **Contact support** button. This opens a form where you can provide details about the issue you're facing.
1. Fill in a title and description for the issue you're facing, the phone number and email address where we can reach you.
diff --git a/defender-xdr/copilot-in-defender-device-summary.md b/defender-xdr/copilot-in-defender-device-summary.md
index 078a3973ef3..5e3bb5f6773 100644
--- a/defender-xdr/copilot-in-defender-device-summary.md
+++ b/defender-xdr/copilot-in-defender-device-summary.md
@@ -48,7 +48,7 @@ This capability is also available in the Security Copilot standalone portal thro
The device summary generated by Copilot contains noteworthy information about the device, including:
-- The status of important Microsoft Defender XDR protection capabilities, like attack surface reduction and tamper protection
+- The status of important Microsoft Defender protection capabilities, like attack surface reduction and tamper protection
- Any significant user activity observed, like unusual sign-in attempts
- A list of vulnerable software installed in the device
- The status of other security features, like firewall settings, that contribute to the device's risk
diff --git a/defender-xdr/copilot-in-defender-file-analysis.md b/defender-xdr/copilot-in-defender-file-analysis.md
index c4ba8b4f5a1..aaea212eee0 100644
--- a/defender-xdr/copilot-in-defender-file-analysis.md
+++ b/defender-xdr/copilot-in-defender-file-analysis.md
@@ -42,7 +42,7 @@ The file analysis capability of Copilot in Defender reduces the barrier to learn
The file analysis capability is available in Microsoft Defender for customers who have provisioned access to Security Copilot.
-Security Copilot standalone portal users also have the file analysis capability and other Defender XDR capabilities through the Microsoft Defender XDR plugin. Know more about [preinstalled plugins in Security Copilot](/security-copilot/manage-plugins#preinstalled-plugins).
+Security Copilot standalone portal users also have the file analysis capability and other Defender capabilities through the Microsoft Defender XDR plugin. Know more about [preinstalled plugins in Security Copilot](/security-copilot/manage-plugins#preinstalled-plugins).
## Key features
diff --git a/defender-xdr/create-custom-rbac-roles.md b/defender-xdr/create-custom-rbac-roles.md
index f698c05879f..1666fe29d68 100644
--- a/defender-xdr/create-custom-rbac-roles.md
+++ b/defender-xdr/create-custom-rbac-roles.md
@@ -39,7 +39,7 @@ Creating custom roles for [Microsoft Sentinel data lake](https://aka.ms/data-lak
To create custom roles in Microsoft Defender unified RBAC, you must be assigned one of the following roles or permissions:
- At leastSecurity Administrator in Microsoft Entra ID.
-- All **Authorization** permissions assigned in Microsoft Defender XDR Unified RBAC.
+- All **Authorization** permissions assigned in Microsoft Defender Unified RBAC.
For more information on permissions, see [Permission prerequisites](manage-rbac.md#permissions-prerequisites).
@@ -136,18 +136,18 @@ The following steps describe how to create custom roles in the Microsoft Defende
1. Select **Next** to review and finish creating the role and then select **Submit**.
> [!NOTE]
-> For the Microsoft Defender XDR security portal to start enforcing the permissions and assignments configured in your new or imported roles, you need to activate the new Microsoft Defender unified RBAC model. For more information, see [Activate Microsoft Defender unified RBAC](activate-defender-rbac.md).
+> For the Microsoft Defender portal to start enforcing the permissions and assignments configured in your new or imported roles, you need to activate the new Microsoft Defender unified RBAC model. For more information, see [Activate Microsoft Defender unified RBAC](activate-defender-rbac.md).
## Configure scoped roles for Microsoft Defender for Identity
-You can configure scoped access using Microsoft Defender XDR’s Unified RBAC (URBAC) model for identities managed by Microsoft Defender for Identity (MDI). This allows you to restrict access and visibility to specific Active Directory domains or Organizational units, helping align with team responsibilities and reduce unnecessary data exposure.
+You can configure scoped access using Microsoft Defender Unified RBAC (URBAC) model for identities managed by Microsoft Defender for Identity (MDI). This allows you to restrict access and visibility to specific Active Directory domains or Organizational units, helping align with team responsibilities and reduce unnecessary data exposure.
For more information, see: [Configure scoped access for Microsoft Defender for Identity](/defender-for-identity/configure-scoped-access).
## Configure scoped roles for Microsoft Defender for Cloud
-You can configure scoped access using Microsoft Defender XDR’s Unified RBAC model for resources managed by Microsoft Defender for Cloud. This enables you to limit access and visibility to specific **subscriptions**, **resource groups**, or **individual resources**. By applying scoped roles, you help ensure that team members only see and manage the assets relevant to their responsibilities, reducing unnecessary exposure and improving operational security.
+You can configure scoped access using the Microsoft Defender Unified RBAC model for resources managed by Microsoft Defender for Cloud. This enables you to limit access and visibility to specific **subscriptions**, **resource groups**, or **individual resources**. By applying scoped roles, you help ensure that team members only see and manage the assets relevant to their responsibilities, reducing unnecessary exposure and improving operational security.
For more information, see: [Manage cloud scopes and unified role-based access control](/azure/defender-for-cloud/cloud-scopes-unified-rbac?pivots=defender-portal).
diff --git a/defender-xdr/create-dsi-in-defender.md b/defender-xdr/create-dsi-in-defender.md
index 98d82a992b1..fe81e954f72 100644
--- a/defender-xdr/create-dsi-in-defender.md
+++ b/defender-xdr/create-dsi-in-defender.md
@@ -9,9 +9,11 @@ ms.collection:
- m365-security
- tier1
ms.topic: how-to
-ms.date: 04/23/2025
+ms.date: 06/15/2026
appliesto:
- ✅ Microsoft Defender XDR
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1014
#customer intent: As a security administrator, I want to create data security investigations from the Microsoft Defender portal.
---
@@ -23,7 +25,7 @@ appliesto:
You can now start an investigation on data security incidents from the Microsoft Defender portal with the integration of [Microsoft Purview Data Security Investigations (preview)](/purview/data-security-investigations) and Microsoft Defender XDR.
-Security operations center (SOC) teams can take advantage of this integration to enhance their investigation and response to potential data security incidents like data breaches or data leaks. Data Security Investigations (preview) uses generative AI to analyze impacted data, draws connections to identify risks, and provide actionable insights to protect the organization.
+Security operations center (SOC) teams can take advantage of the integration between Microsoft Purview Data Security Investigations (preview) and Microsoft Defender XDR to enhance their investigation and response to potential data security incidents like data breaches or data leaks. Data Security Investigations (preview) uses generative AI to analyze impacted data, draws connections to identify risks, and provide actionable insights to protect your organization.
SOC teams can start an investigation in Data Security Investigations (preview) from an incident page where a potentially affected data set is in the Microsoft Defender portal.
@@ -34,15 +36,15 @@ To create investigations in Data Security Investigations (preview) in the Micros
- Security Administrator
- Security Operator
-To view and access the investigation in Data Security Investigations (preview) in the Microsoft Purview portal, the *Data Security Investigations Administrator* [permission](/purview/data-security-investigations-permissions) is required.
+To view and access the investigation in Data Security Investigations (preview) in the Microsoft Purview portal, the *Data Security Investigations Administrator* [Data Security Investigations permissions](/purview/data-security-investigations-permissions) role is required.
## Create a data security investigation
-Microsoft Defender XDR identifies possibly impacted sensitive data in incidents, where you can start creating an investigation in Data Security Investigations (preview). Investigations support mailboxes, files, and mail messages as the scope of the investigation.
+Microsoft Defender XDR identifies possibly impacted sensitive data in incidents. You can start creating an investigation in Data Security Investigations (preview) from the incident page in the Microsoft Defender portal. Investigations support mailboxes, files, and mail messages as the scope of the investigation.
To create an investigation in Data Security Investigations (preview) in the Microsoft Defender portal, follow these steps:
-1. Sign in to the Microsoft Defender portal at [security.microsoft.com](https://security.microsoft.com).
+1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com).
2. In the navigation pane, select **Investigation & response** > **Incidents & alerts** > **Incidents** to open the incident queue. Select an incident from the queue to open the incident page.
3. When the selected incident contains potentially impacted data, the option to create a Data Security investigation appears on the incident page message banner. Choose **Investigate this incident**.
:::image type="content" source="media/create-dsi-in-defender/xdr-dsi-banner-small.png" alt-text="Screenshot of the incident page highlighting the create investigation message banner" lightbox="media/create-dsi-in-defender/xdr-dsi-banner.png":::
diff --git a/defender-xdr/custom-detection-manage.md b/defender-xdr/custom-detection-manage.md
index bd940002083..94c92f3db08 100644
--- a/defender-xdr/custom-detection-manage.md
+++ b/defender-xdr/custom-detection-manage.md
@@ -31,7 +31,7 @@ ai-usage: ai-assisted
You can view the list of existing custom detection rules, check their previous runs, and review the alerts that were triggered. You can also run a rule on demand, modify it, or create a new custom detection rule directly from the list.
> [!TIP]
-> Alerts raised by custom detections are available over alerts and incident APIs. For more information, see [Supported Microsoft Defender XDR APIs](api-supported.md).
+> Alerts raised by custom detections are available over alerts and incident APIs. For more information, see [Supported Microsoft Defender APIs](api-supported.md).
For users who have onboarded a Microsoft Sentinel workspace to the unified Microsoft Defender portal, the custom detection rules list includes [analytics rules](advanced-hunting-defender-use-custom-rules.md#analytics-rules). The [View existing rules](#view-existing-rules) and [View rule details, modify rule, and run rule](#view-rule-details-modify-rule-and-run-rule) sections also apply to analytics rules unless otherwise indicated.
diff --git a/defender-xdr/custom-detection-rules.md b/defender-xdr/custom-detection-rules.md
index 9917a10fd91..4085be0f6b0 100644
--- a/defender-xdr/custom-detection-rules.md
+++ b/defender-xdr/custom-detection-rules.md
@@ -22,7 +22,7 @@ appliesto:
- Microsoft Sentinel in the Microsoft Defender portal
- Microsoft Defender for Endpoint Plan 2
ms.topic: how-to
-ms.date: 06/16/2026
+ms.date: 07/02/2026
ai-usage: ai-assisted
#customer intent: As a security administrator, I want to create custom detection rules so that I can proactively monitor for threats and automate response actions using advanced hunting queries.
---
@@ -35,18 +35,18 @@ Custom detection rules are [advanced hunting](advanced-hunting-overview.md) quer
## Required permissions for managing custom detections
-To manage custom detections, you need roles with permissions for the data these detections target. For example, to manage custom detections on multiple data sources (Microsoft Defender XDR and Microsoft Sentinel, or multiple Defender workloads), you need all the applicable Defender XDR and Sentinel roles. For more information, see [Microsoft Defender XDR](#microsoft-defender-xdr) and [Microsoft Sentinel](#microsoft-sentinel).
+To manage custom detections, you need roles with permissions for the data these detections target. For example, to manage custom detections on multiple data sources (Microsoft Defender and Microsoft Sentinel, or multiple Defender workloads), you need all the applicable Defender and Sentinel roles. For more information, see the following sections.
### Microsoft Defender XDR
-To manage custom detections on Microsoft Defender XDR data, you need to be assigned one of these roles:
+To manage custom detections on Microsoft Defender data, you need to be assigned one of these roles:
-- **Security settings (manage)** - Users with this [Microsoft Defender XDR permission](manage-rbac.md) can manage security settings in the Microsoft Defender portal.
+- **Security settings (manage)** - Users with this [Microsoft Defender permission](manage-rbac.md) can manage security settings in the Microsoft Defender portal.
- **Security Administrator** - Users with this [Microsoft Entra role](/azure/active-directory/roles/permissions-reference#security-administrator) can manage security settings in the Microsoft Defender portal and other portals and services.
- **Security Operator** - Users with this [Microsoft Entra role](/azure/active-directory/roles/permissions-reference#security-operator) can manage alerts and have global read-only access to security-related features, including all information in the Microsoft Defender portal. This role is sufficient for managing custom detections only if role-based access control (RBAC) is turned off in Microsoft Defender for Endpoint. If you have RBAC configured, you also need the **Manage Security Settings** permission for Defender for Endpoint.
-You can manage custom detections that apply to data from specific Defender XDR solutions if you have the right permissions for them. For example, if you only have manage permissions for Microsoft Defender for Office 365, you can create custom detections using `Email*` tables but not `Identity*` tables.
+You can manage custom detections that apply to data from specific Defender solutions if you have the right permissions for them. For example, if you only have manage permissions for Microsoft Defender for Office 365, you can create custom detections using `Email*` tables but not `Identity*` tables.
Likewise, since the `IdentityLogonEvents` table holds authentication activity information from both Microsoft Defender for Cloud Apps and Defender for Identity, you need to have manage permissions for both services to manage custom detections querying that table.
@@ -96,12 +96,12 @@ In the Microsoft Defender portal, go to **Advanced hunting** and select an exist
#### Required columns in the query results
-To create a custom detection rule by using Defender XDR data, we recommend that the query returns the following columns:
+To create a custom detection rule by using Defender data, we recommend that the query returns the following columns:
1. `Timestamp` or `TimeGenerated` - This column sets the timestamp for generated alerts. If these columns aren't projected from the KQL, the first and last event time for the generated alert is set according to the lookback window of the detection.
1. **For Microsoft Defender for Endpoint tables**, include `DeviceId` or `DeviceName` columns to ensure that:
- Alerts are tagged with the correct device group scope
- Process tree view is built successfully.
-1. **For all other XDR tables**, project `Timestamp` and `ReportId` from the same event to ensure Defender XDR identifies the original event that triggered the alert so that:
+1. **For all other Defender tables**, project `Timestamp` and `ReportId` from the same event to ensure Defender identifies the original event that triggered the alert so that:
- Alerts are tagged with the correct entity scope (only relevant for organizations that use Defender XDR scopes)
- Alert timeline view is fully enriched with relevant data.
1. To map an impacted asset automatically in the wizard, project one of the following columns that contain a strong identifier for an impacted asset:
@@ -159,7 +159,9 @@ In the query editor, select **Create detection rule** and specify the following
- **Alert title** - Title displayed with alerts triggered by the rule; make it unique and use plaintext. Strings are sanitized for security purposes, so HTML, Markdown, and other code don't work. Any URLs included in the title should follow the [percent-encoding format](https://en.m.wikipedia.org/wiki/Percent-encoding) for them to display properly.
- **Severity** - Potential risk of the component or activity identified by the rule.
- **Category** - Threat component or activity identified by the rule.
-- **MITRE ATT&CK techniques** - One or more attack techniques identified by the rule as documented in the [MITRE ATT&CK framework](https://attack.mitre.org/). The MITRE ATT&CK techniques field is hidden for certain alert categories, including malware, ransomware, suspicious activity, and unwanted software.
+- **Tactic** - MITRE ATT&CK tactic identified by the rule as documented in the [MITRE ATT&CK framework](https://attack.mitre.org/).
+- **Techniques** - One or more attack techniques identified by the rule as documented in the MITRE ATT&CK framework.
+- **Sub-techniques** - One or more attack sub-techniques identified by the rule as documented in the MITRE ATT&CK framework.
- **Threat analytics report** - Link the generated alert to an existing threat analytics report so that it appears in the [Related incidents](threat-analytics.md#set-up-custom-detections-and-link-them-to-threat-analytics-reports) tab in threat analytics.
- **Description** - More information about the component or activity identified by the rule. Strings are sanitized for security purposes, so HTML, Markdown, and other code don't work. Any URLs included in the description should follow the percent-encoding format for them to display properly.
- **Recommended actions** - Additional actions that responders might take in response to an alert.
@@ -227,7 +229,7 @@ When you select this frequency option, the **Run query every input** component a
> [!IMPORTANT]
>When you select a custom frequency, Defender fetches your data from Microsoft Sentinel. This condition means that:
>1. You must have data available in Microsoft Sentinel.
->1. Defender XDR data doesn't support scoping, since Microsoft Sentinel doesn't support scoping.
+>1. Defender data doesn't support scoping, since Microsoft Sentinel doesn't support scoping.
#### Lookback
@@ -337,7 +339,7 @@ After selecting the identifier, select a column from the query results that cont
### 4. Specify actions
-If your custom detection rule uses Defender XDR data, it can automatically take actions on devices, files, users, or emails that the query returns.
+If your custom detection rule uses Defender data, it can automatically take actions on devices, files, users, or emails that the query returns.
:::image type="content" source="media/custom-detection-rules/ah-custom-actions.png" alt-text="Screenshot that shows actions for custom detections in the Microsoft Defender portal." lightbox="media/custom-detection-rules/ah-custom-actions.png":::
diff --git a/defender-xdr/custom-detections-overview.md b/defender-xdr/custom-detections-overview.md
index 06fbf226272..1ec9d8103a1 100644
--- a/defender-xdr/custom-detections-overview.md
+++ b/defender-xdr/custom-detections-overview.md
@@ -36,6 +36,10 @@ Custom detections provide:
Optimizing your queries in custom detection rules is important in avoiding time-outs and ensuring efficiency. There are several resources available that provide guidance on optimizing your queries in [Advanced hunting query best practices](advanced-hunting-best-practices.md).
+## Manage custom detections as code (Preview)
+
+You can manage custom detection rules as code in a GitHub or Azure DevOps repository using the Microsoft Security BICEP extension. Deploy custom detections through Microsoft Sentinel Repositories for automatic sync, or use BICEP CLI for custom pipelines. For more information, see [Deploy custom detection rules as code](/azure/sentinel/ci-cd-custom-content#deploy-custom-detection-rules-as-code-preview).
+
## See also
- [Create and manage custom detection rules](custom-detection-rules.md)
diff --git a/defender-xdr/custom-roles.md b/defender-xdr/custom-roles.md
index 719a1989dba..43a4d3ee6e7 100644
--- a/defender-xdr/custom-roles.md
+++ b/defender-xdr/custom-roles.md
@@ -1,6 +1,6 @@
---
title: Custom roles for role-based access control
-description: Learn how to manage custom roles for Microsoft Defender XDR in the Microsoft Defender portal.
+description: Learn how to manage custom roles for Microsoft Defender in the Microsoft Defender XDR portal.
ms.service: defender-xdr
ms.author: guywild
author: guywi-ms
@@ -54,7 +54,7 @@ For information about the permissions and roles for each Microsoft Defender XDR
- [Roles and permissions in **Defender for Identity**](/defender-for-identity/role-groups)
- [Microsoft **Defender for IoT** user management](/azure/defender-for-iot/organizations/manage-users-overview)
- [Microsoft **Defender for Office 365** permissions](/defender-office-365/mdo-portal-permissions)
-- [Manage access to **Microsoft Defender XDR**](m365d-permissions.md)
+- [Manage access to **Microsoft Defender**](m365d-permissions.md)
- [**Microsoft Security Exposure Management** permissions](/security-exposure-management/prerequisites#permissions)
- [Roles and permissions in **Microsoft Sentinel**](/azure/sentinel/roles)
diff --git a/defender-xdr/data-privacy.md b/defender-xdr/data-privacy.md
index f8301b73ca8..a43ec031187 100644
--- a/defender-xdr/data-privacy.md
+++ b/defender-xdr/data-privacy.md
@@ -29,7 +29,7 @@ Customer data collected from integrated services includes *processed data*, such
## Data storage location
-Microsoft Defender XDR operates in Microsoft Azure data centers in the following geographical regions:
+Microsoft Defender operates in Microsoft Azure data centers in the following geographical regions:
- **European Union**: North Europe and West Europe
- **United Kingdom**: UK South and UK West
@@ -39,16 +39,16 @@ Microsoft Defender XDR operates in Microsoft Azure data centers in the following
- **India**: Central India and South India
- **UAE**: UAE North and UAE Central
-Once created, the Microsoft Defender XDR tenant can't be moved to a different region. Your geographical region is shown in the Microsoft Defender portal, under **Settings > Microsoft Defender XDR > Account**.
+Once created, the Microsoft Defender tenant can't be moved to a different region. Your geographical region is shown in the Microsoft Defender portal, under **Settings > Microsoft Defender XDR > Account**.
Customer data stored by integrated services might also be stored in the following locations:
- The original location for the relevant service.
-- A region defined by data storage rules of an integrated service, if Microsoft Defender XDR shares data with that service.
+- A region defined by data storage rules of an integrated service, if Microsoft Defender shares data with that service.
## Data retention
-Microsoft Defender XDR data is retained for 180 days, and is visible across the Microsoft Defender portal during that time, except for in **Advanced hunting** queries. Cases are an exception and are not deleted.
+Microsoft Defender data is retained for 180 days, and is visible across the Microsoft Defender portal during that time, except for in **Advanced hunting** queries. Cases are an exception and are not deleted.
In the Microsoft Defender portal's **Advanced hunting** page, data is accessible via queries for only 30 days, unless it's streamed through [Microsoft Sentinel](/azure/sentinel/microsoft-365-defender-sentinel-integration?toc=%2Fdefender-xdr%2Ftoc.json&bc=%2Fdefender-xdr%2Fbreadcrumb%2Ftoc.json&tabs=defender-portal), where retention periods may be longer.
@@ -58,7 +58,7 @@ Most Defender services also have a default data retention period of 180 days. Mo
## Data sharing
-Microsoft Defender XDR shares data among the following Microsoft products, also licensed by the customer. For customers in the Government Community Cloud (GCC), data sharing between government and commercial cloud environments may occur, depending on the location of the service offering.
+Microsoft Defender shares data among the following Microsoft products, also licensed by the customer. For customers in the Government Community Cloud (GCC), data sharing between government and commercial cloud environments may occur, depending on the location of the service offering.
- Microsoft Defender for Cloud
- Microsoft Defender for Identity
diff --git a/defender-xdr/defender-experts-for-hunting.md b/defender-xdr/defender-experts-for-hunting.md
deleted file mode 100644
index 3186ab38f10..00000000000
--- a/defender-xdr/defender-experts-for-hunting.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-title: What is Microsoft Defender Experts for Hunting offering
-ms.reviewer:
-description: Microsoft Defender Experts for Hunting is a proactive threat hunting service that goes beyond the endpoint to hunt across endpoints
-ms.service: defender-experts-for-hunting
-ms.author: pauloliveria
-author: poliveria
-ms.localizationpriority: medium
-ms.collection:
- - m365-security
- - tier1
- - essentials-overview
-ms.topic: overview
-ms.custom:
-- cx-ti
-- cx-ean
-ms.date: 08/01/2025
----
-
-# Microsoft Defender Experts for Hunting
-
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
-
-**Applies to:**
-
-- [Microsoft Defender XDR](microsoft-365-defender.md)
-
-> [!IMPORTANT]
-> Microsoft Defender Experts for Hunting is sold separately from other Microsoft Defender XDR products. If you're a Microsoft Defender XDR customer and are interested in purchasing Microsoft Defender Experts for Hunting - XDR and the Microsoft Defender Experts for Hunting - Servers add-on, complete this [customer interest form](https://aka.ms/DEX4HuntingCustomerInterestForm).
-
-> [!NOTE]
-> Any incident response services offered by Defender Experts will be offered under the Defender Experts Service Terms.
-
-Microsoft Defender Experts for Hunting was created for customers who have a robust security operations center but want Microsoft to help them proactively hunt threats using Microsoft Defender data:
-
-- **Microsoft Defender Experts for Hunting - XDR** is a proactive threat hunting service that goes beyond the endpoint to hunt across endpoints, Microsoft 365, cloud applications, and identity
-- **Microsoft Defender Experts for Hunting - Servers** is an add-on to Defender Experts for Hunting - XDR, providing proactive threat hunting for hybrid and multicloud servers
-
-Our experts will investigate anything they find, then hand off the contextual alert information along with remediation instructions, so you can quickly respond.
-
-The following capabilities included in this managed threat hunting service could also help with your daily SecOps work:
-
-- **Threat hunting and analysis** – Defender Experts for Hunting look deeper to expose advanced threats and identify the scope and impact of malicious activity associated with human adversaries or hands-on-keyboard attacks.
-- **Defender Experts Notifications** – Notifications show up as incidents in Microsoft Defender XDR, helping to improve your security operations' incident response with specific information about the scope, method of entry, and remediation instructions.
-- **Ask Defender Experts** – Select [**Ask Defender Experts**](experts-on-demand.md) in the Microsoft Defender portal to get expert advice about threats your organization is facing. You can ask for help on a specific incident, nation-state actor, or attack vector-related notifications.
-- **Hunter-trained AI** – Our Defender Experts for Hunting share their learning back into the automated tools they use to improve threat discovery and prioritization.
-- **Reports** – An interactive report summarizing what we hunted and what we found.
-
-[Watch this short video](https://youtu.be/4t1JgE0X0jc) to learn more about how Microsoft Defender Experts for Hunting can help you track the latest advanced threats in your environment.
-
-### Next step
-
-- [Before you begin using Defender Experts for Hunting](before-you-begin-defender-experts.md)
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/faq-cloud-coverage-defender-experts.md b/defender-xdr/defender-experts/defender-experts-faq-cloud-coverage.md
similarity index 72%
rename from defender-xdr/faq-cloud-coverage-defender-experts.md
rename to defender-xdr/defender-experts/defender-experts-faq-cloud-coverage.md
index c1ac2bbab85..a992e17ce0e 100644
--- a/defender-xdr/faq-cloud-coverage-defender-experts.md
+++ b/defender-xdr/defender-experts/defender-experts-faq-cloud-coverage.md
@@ -20,7 +20,7 @@ ms.date: 05/18/2026
**Applies to:**
-- [Microsoft Defender XDR](microsoft-365-defender.md)
+- [Microsoft Defender](../microsoft-365-defender.md)
The following section lists down questions you or your SOC team might have regarding Microsoft Defender Experts coverage for servers and cloud workloads.
@@ -28,12 +28,12 @@ The following section lists down questions you or your SOC team might have regar
|---------|---------|
|**Can I configure which servers the Defender Experts will cover?** | This service covers **all** your servers in your tenant that have [Defender for Servers](/azure/defender-for-cloud/defender-for-servers-overview) protection enabled in Defender for Cloud. |
|**Do the Defender Experts investigate all Defender for Servers alerts?** | The Defender for Servers plan in Defender for Cloud covers multicloud servers, such as Microsoft Azure, Amazon Web Services, and Google Cloud Platform, provided the Microsoft Defender for Endpoint is installed on the servers. All Defender for Servers P1 and P2 alerts (Detection Source = Microsoft Defender for Servers) are in scope except for [DNS alerts](/azure/defender-for-cloud/alerts-dns) due to limited data available for investigation. |
-|**I only have Microsoft Defender Endpoint. How can I get server coverage?** | If you have servers that have Defender for Endpoint deployed on them with a Microsoft Defender for Endpoint for Server license, you can get the server coverage through the Defender Experts for XDR service. The service doesn't cover Microsoft Defender for Cloud workloads. [Learn more](before-you-begin-xdr.md#product-configuration-and-service-coverage)
If you want coverage for servers in Defender for Cloud, you need to avail the Microsoft Defender Experts for Servers or Defender Experts for Hunting - Servers. |
+|**I only have Microsoft Defender Endpoint. How can I get server coverage?** | If you have servers that have Defender for Endpoint deployed on them with a Microsoft Defender for Endpoint for Server license, you can get the server coverage through the Defender Experts MDR service. The service doesn't cover Microsoft Defender for Cloud workloads. [Learn more](defender-experts-mdr-prerequisites.md#product-configuration-and-service-coverage)
If you want coverage for servers in Defender for Cloud, you need to avail the Microsoft Defender Experts for Servers or Defender Experts Hunting - Servers. |
### See also
-- [General information on Defender Experts for XDR service](frequently-asked-questions.md)
-- [General information on Microsoft Defender Experts for Hunting service](faq-defender-experts-hunting.md)
+- [General information on Defender Experts MDR service](defender-experts-mdr-faq.md)
+- [General information on Microsoft Defender Experts Hunting service](defender-experts-hunting-faq.md)
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/experts-on-demand.md b/defender-xdr/defender-experts/defender-experts-hunting-ask-experts.md
similarity index 88%
rename from defender-xdr/experts-on-demand.md
rename to defender-xdr/defender-experts/defender-experts-hunting-ask-experts.md
index 13b34766927..7d93adbdcd7 100644
--- a/defender-xdr/experts-on-demand.md
+++ b/defender-xdr/defender-experts/defender-experts-hunting-ask-experts.md
@@ -27,14 +27,14 @@ ai-usage: ai-assisted
# Collaborate with experts on demand
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/microsoft-defender.md)]
**Applies to:**
-- [Microsoft Defender XDR](microsoft-365-defender.md)
+- [Microsoft Defender](../microsoft-365-defender.md)
> [!NOTE]
-> Ask Defender Experts is included in your Defender Experts for Hunting subscription with [quarterly allocations](before-you-begin-defender-experts.md#eligibility-and-licensing).
+> Ask Defender Experts is included in your Defender Experts Hunting subscription with [quarterly allocations](defender-experts-hunting-prerequisites.md#eligibility-and-licensing).
Select **Ask Defender Experts** directly inside the Microsoft 365 security portal to get swift and accurate responses to all your threat hunting questions. Experts can provide insight to better understand the complex threats your organization might face. Ask Defender Experts can help:
@@ -55,9 +55,9 @@ To view and submit inquiries to Defender experts, select one of the following Mi
| Global Reader | Read inquiries |
| Security Admin, Security Operator, or Security Reader | Read and submit inquiries |
-To learn more about how Microsoft Entra ID roles map to Microsoft Defender unified RBAC permissions, see [Microsoft Entra Global roles access](compare-rbac-roles.md#microsoft-entra-global-roles-access).
+To learn more about how Microsoft Entra ID roles map to Microsoft Defender unified RBAC permissions, see [Microsoft Entra Global roles access](../compare-rbac-roles.md#microsoft-entra-global-roles-access).
-Microsoft Threat Experts customers using Ask Defender Experts can also use the following permissions from [Microsoft Defender unified RBAC](../defender-xdr/custom-permissions-details.md).
+Microsoft Threat Experts customers using Ask Defender Experts can also use the following permissions from [Microsoft Defender unified RBAC](../custom-permissions-details.md).
|Microsoft Defender unified RBAC role|Permission level|
|---|---|---|
@@ -113,7 +113,7 @@ Examples of alert-related questions include the following:
- We saw a new type of alert for a living-off-the-land binary. We can provide the alert ID. Can you tell us more about this alert and if it's related to any incident and how we can investigate it further?
- We've observed two similar attacks, which both try to execute malicious PowerShell scripts but generate different alerts. One is "Suspicious PowerShell command line" and the other is "A malicious file was detected based on indication provided by Office 365." What is the difference?
-- We received an odd alert today about an abnormal number of failed logins from a high profile user's device. We can't find any further evidence for these attempts. How can Microsoft Defender XDR see these attempts? What type of logins are being monitored?
+- We received an odd alert today about an abnormal number of failed logins from a high profile user's device. We can't find any further evidence for these attempts. How can Microsoft Defender see these attempts? What type of logins are being monitored?
- Can you give more context or insight about the alert and any related incidents, "Suspicious behavior by a system utility was observed"?
- I observed an alert titled "Creation of forwarding/redirect rule". I believe the activity is benign. Can you tell me why I received an alert?
@@ -131,21 +131,21 @@ Examples of device-compromise questions include the following:
You can ask Defender Experts questions like the following about threat intelligence:
- We detected a phishing email that delivered a malicious Word document to a user. The document caused a series of suspicious events, which triggered multiple alerts for a particular malware family. Do you have any information on this malware? If yes, can you send us a link?
-- We recently saw a blog post about a threat that is targeting our industry. Can you help us understand what protection Microsoft Defender XDR provides against this threat actor?
+- We recently saw a blog post about a threat that is targeting our industry. Can you help us understand what protection Microsoft Defender provides against this threat actor?
- We recently observed a phishing campaign conducted against our organization. Can you tell us if this was targeted specifically to our company or vertical?
-### Questions about Defender Experts for Hunting alert communications
+### Questions about Defender Experts Hunting alert communications
-The following are examples of questions related to Defender Experts for Hunting notifications:
+The following are examples of questions related to Defender Experts Hunting notifications:
- Can your incident response team help us address the Defender Experts Notification that we got?
-- We received this Defender Experts Notification from Microsoft Defender Experts for Hunting. We don't have our own incident response team. What can we do now, and how can we contain the incident?
-- We received a Defender Experts Notification from Microsoft Defender Experts for Hunting. What data can you provide to us that we can pass on to our incident response team?
+- We received this Defender Experts Notification from Microsoft Defender Experts Hunting. We don't have our own incident response team. What can we do now, and how can we contain the incident?
+- We received a Defender Experts Notification from Microsoft Defender Experts Hunting. What data can you provide to us that we can pass on to our incident response team?
## Services that aren't in scope for Defender Experts
-Ask Defender Experts is focused on products that are only included in Microsoft Defender XDR, that is, Microsoft Defender for Endpoint, Microsoft Defender for Office, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity.
+Ask Defender Experts is focused on products that are only included in Microsoft Defender, that is, Microsoft Defender for Endpoint, Microsoft Defender for Office, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity.
Ask Defender Experts doesn't cover the following scenarios:
@@ -168,5 +168,6 @@ After you submit inquiries and review responses, learn how to interpret the find
For more information, see the following resource:
-- [Understand the Defender Experts for Hunting report in Microsoft Defender XDR](defender-experts-report.md)
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
+- [Understand the Defender Experts Hunting report in Microsoft Defender](defender-experts-hunting-report.md)
+
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/defender-experts/defender-experts-hunting-faq.md b/defender-xdr/defender-experts/defender-experts-hunting-faq.md
new file mode 100644
index 00000000000..0d7f5f3cbf1
--- /dev/null
+++ b/defender-xdr/defender-experts/defender-experts-hunting-faq.md
@@ -0,0 +1,53 @@
+---
+title: FAQs related to Microsoft Defender Experts Hunting service
+ms.reviewer:
+description: Frequently asked questions related to the Microsoft Defender Experts Hunting service
+ms.service: defender-experts-for-hunting
+ms.author: pauloliveria
+author: poliveria
+ms.localizationpriority: medium
+ms.collection:
+ - m365-security
+ - tier1
+ - essentials-get-started
+ms.topic: faq
+ms.custom:
+- cx-ti
+- cx-ean
+ms.date: 06/27/2025
+---
+
+# General information on Microsoft Defender Experts Hunting service
+
+**Applies to:**
+
+- [Microsoft Defender Experts Hunting](defender-experts-hunting-overview.md)
+- [Microsoft Defender](../microsoft-365-defender.md)
+
+The following section lists down questions your security operations center (SOC) team might have about the Microsoft Defender Experts Hunting service:
+
+| Questions | Answers |
+|---------|---------|
+| **What is the Microsoft Defender Experts Hunting service?** | [Microsoft Defender Experts Hunting](defender-experts-hunting-overview.md) provides a proactive threat hunting service to identify threats in advance.
[Microsoft Defender Experts MDR](defender-experts-mdr-overview.md) also includes the proactive threat hunting offered by Defender Experts Hunting.|
+|**Does Defender Experts Hunting use or require Microsoft Sentinel or a security information and event management (SIEM) platform?**| No. This service doesn't use any non-Microsoft data ingested either through Microsoft Sentinel or any other SIEM platform.|
+|**What products does Defender Experts Hunting operate on?**| Defender Experts Hunting relies on event signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, Microsoft Entra ID protection, and Microsoft Defender for Identity. It also relies on proprietary Microsoft Threat Intelligence sources. Any event definitions not authored by Microsoft Defender products, such as third-party events or detections, fall outside the scope of this service.|
+|**What is the role of Defender Experts Hunting in the context of a purple team (red team and blue team coordinated work stream) exercise?**| Defender Experts Hunting is part of the blue team in a purple team exercise. It complements your internal hunting team by enhancing their capabilities rather than replacing them.|
+|**What actions can your experts take during a hunting investigation that results in a Defender Experts Notification?**| During threat hunting investigations, our analysts refrain from taking direct actions on customer assets. Instead, they provide detailed information, including a threat summary and hunting queries that show the timeline of events for the identified attack, and remediation action recommendations. Defender Experts Notifications provide guidance on how you can review and address the novel threat.|
+|**What types of incidents can your experts investigate?**| The Defender Experts Hunting service specializes in addressing the evolving threat landscape, bridging industry knowledge gaps, and recommending the most effective ways to identify these threats. Our experts don't prioritize well-established threats that Microsoft Defender products address adequately. However, when a well-known tactic is employed to generate a novel attack, our experts identify both the novel and existing attack tactics diligently. [Learn more about novel attacks in our in the Microsoft Security Experts Blog](https://techcommunity.microsoft.com/tag/Defender%20Experts%20for%20Hunting?nodeId=board%3AMicrosoftSecurityExperts)|
+|**Can your experts help me improve my security posture?**| The scope of the posture change recommendation is limited to the scope of a Defender Experts Notification and is limited to preventing the attack identified in the context of the notification.|
+|**Can Defender Experts Hunting help with an active compromise or vulnerability?**| No, Defender Experts currently don't provide incident response services.|
+|**How can my organization participate in the Defender Experts Hunting service?**| Reach out to your Microsoft representative to express your interest in Defender Experts Hunting.|
+|**Does Defender Experts Hunting cover cloud servers that have Microsoft Defender for Endpoint deployed on them?**| Defender Experts Hunting covers servers—whether on premises or on a hyperscale cloud service provider—that have Microsoft Defender for Endpoint deployed on them with a Microsoft Defender for Endpoint for Servers license. For Defender Experts coverage, a server is considered as a license for billing. The service doesn't cover Microsoft Defender for Cloud. [Learn more about specific hardware and software requirements](/defender-endpoint/minimum-requirements)|
+|**Once I see a Defender Experts Notification, if I have questions, how do I communicate with the Defender Experts Hunting team?**| The **Ask Defender Experts** option in the Microsoft Defender portal delivers swift and accurate responses to all your threat-hunting questions. However, this service is limited to questions related specifically to Defender Experts Hunting. [Learn more about Ask Defender Experts](defender-experts-hunting-ask-experts.md)|
+|**What kinds of inquiries could I submit in Ask Defender Experts?**| Ask Defender Experts is intended to provide a better understanding of complex threats affecting your organization. It focuses on products included in Microsoft Defender (Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, and Defender for Identity). It doesn't answer inquiries related to custom detections in the above products (that is, non-Defender and third-party cybersecurity products), bugs in your product experience in the Defender portal, and those related to security incident response services. [See some sample questions you can ask our Defender Experts](defender-experts-hunting-ask-experts.md#sample-questions-you-can-ask-from-defender-experts)|
+|**What certifications does the Defender Experts Hunting service have?**| Defender Experts Hunting is certified for [HIPAA and ISO](/compliance/regulatory/offering-hipaa-hitech).|
+|**How is customer data protected?**| For more information about Microsoft's commitment in valuing and protecting your data, see [Data collection, usage, and retention](defender-experts-hunting-prerequisites.md#data-collection-usage-and-retention). You can also visit the [Trust Center](https://www.microsoft.com/trust-center/product-overview) then scroll down to **Additional products and services** > **Managed Security Services** > **Microsoft Defender Experts**.|
+|**Does the hunting service offer real-time threat remediation with boots on ground?**| No, the hunting service doesn't cover real-time threat remediation.
Despite this, Microsoft provides professional on-site service through our [Microsoft Defender Experts Cybersecurity Incident Response team](https://www.microsoft.com/security/business/microsoft-incident-response?msockid=2c408e0b54cc68301f9a9b55554869f3). This service requires a separate contract. We prioritize customer needs and have a swift turnaround time. Contact your Customer Service Account Manager for further assistance.|
+|**Is there a graph API that can fetch Defender Experts Notifications content?**| Yes. For more information, see [Access incident notifications using Graph API](defender-experts-hunting-graph-api.md).|
+|**How is AI used in the Defender Experts service?**| AI is used to support the Defender Experts service by enhancing the speed, scale, and consistency of security operations. We use a combination of generative, agentic, and foundational AI to power workflows such as incident triage, investigation, and summarization by analyzing signals like telemetry and historical analyst actions. Defender Experts analysts review and validate these AI-generated insights to ensure quality and accuracy. AI helps scale expert capabilities, and human analysts remain central to the service, ensuring customers receive trusted outcomes.|
+
+### See also
+- [Before you begin using Defender Experts Hunting](defender-experts-hunting-prerequisites.md)
+- [Start using Defender Experts Hunting](defender-experts-hunting-onboarding.md)
+
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
\ No newline at end of file
diff --git a/defender-xdr/access-den-graph-api.md b/defender-xdr/defender-experts/defender-experts-hunting-graph-api.md
similarity index 82%
rename from defender-xdr/access-den-graph-api.md
rename to defender-xdr/defender-experts/defender-experts-hunting-graph-api.md
index 71f5b096bc6..d99da4287b9 100644
--- a/defender-xdr/access-den-graph-api.md
+++ b/defender-xdr/defender-experts/defender-experts-hunting-graph-api.md
@@ -16,13 +16,13 @@ ms.custom:
- cx-ean
ms.date: 06/16/2026
appliesto:
- - Microsoft Defender XDR
+ - Microsoft Defender
ai-usage: ai-assisted
---
# Access incident notifications using Graph API
-[Defender Experts Notifications](onboarding-defender-experts-for-hunting.md#receive-defender-experts-notifications) are incidents that have been generated from hunting conducted by Defender Experts in your environment. They contain information regarding the hunting investigation and recommended actions provided by Defender Experts. You can now access DENs using the [Microsoft Graph security API](/graph/api/resources/security-api-overview).
+[Defender Experts Notifications](defender-experts-hunting-onboarding.md#receive-defender-experts-notifications) are incidents that have been generated from hunting conducted by Defender Experts in your environment. They contain information regarding the hunting investigation and recommended actions provided by Defender Experts. You can now access DENs using the [Microsoft Graph security API](/graph/api/resources/security-api-overview).
> [!NOTE]
> Any incident in the Microsoft Defender portal is a collection of correlated alerts. [Microsoft Graph security incident resource type](/graph/api/resources/security-incident)
@@ -66,5 +66,5 @@ Your approach to consuming Defender Experts Notifications from the API will vary
## Next step
-- [Collaborate with Experts on Demand](experts-on-demand.md)
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
+- [Collaborate with Experts on Demand](defender-experts-hunting-ask-experts.md)
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/onboarding-defender-experts-for-hunting.md b/defender-xdr/defender-experts/defender-experts-hunting-onboarding.md
similarity index 67%
rename from defender-xdr/onboarding-defender-experts-for-hunting.md
rename to defender-xdr/defender-experts/defender-experts-hunting-onboarding.md
index 3a6dbf4eb72..931d320a88a 100644
--- a/defender-xdr/onboarding-defender-experts-for-hunting.md
+++ b/defender-xdr/defender-experts/defender-experts-hunting-onboarding.md
@@ -1,8 +1,8 @@
---
-title: Subscribe to Microsoft Defender Experts for Hunting
+title: Subscribe to Microsoft Defender Experts Hunting
ms.reviewer:
-description: If you're new to Microsoft Defender XDR and Defender Experts for Hunting, this is how you onboard, receive, and set up Defender Experts Notifications.
-#customer intent: As a security admin, I want to onboard to Defender Experts for Hunting so that I can receive expert threat notifications and respond to security incidents.
+description: If you're new to Microsoft Defender and Defender Experts Hunting, this is how you onboard, receive, and set up Defender Experts Notifications.
+#customer intent: As a security admin, I want to onboard to Defender Experts Hunting so that I can receive expert threat notifications and respond to security incidents.
ms.service: defender-experts-for-hunting
ms.author: pauloliveria
author: poliveria
@@ -21,30 +21,30 @@ ai-usage: ai-assisted
ms.date: 06/16/2026
---
-# Start using Microsoft Defender Experts for Hunting
+# Start using Microsoft Defender Experts Hunting
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/microsoft-defender.md)]
**Applies to:**
-- [Microsoft Defender XDR](microsoft-365-defender.md)
+- [Microsoft Defender](../microsoft-365-defender.md)
-To get started with the Microsoft Defender Experts for Hunting service, onboard to the service, set up notification contacts, and configure Defender Experts Notifications.
+To get started with the Microsoft Defender Experts Hunting service, onboard to the service, set up notification contacts, and configure Defender Experts Notifications.
-## Onboard to Defender Experts for Hunting
+## Onboard to Defender Experts Hunting
-If you're new to Microsoft Defender XDR and Defender Experts for Hunting:
+If you're new to Microsoft Defender and Defender Experts Hunting:
-1. When you receive your welcome email, select **Log into Microsoft Defender XDR**.
+1. When you receive your welcome email, select **Log into Microsoft Defender**.
1. Sign in if you already have a Microsoft account. If you don't have a Microsoft account, create one.
-1. The Microsoft Defender XDR quick tour introduces you to the security suite, where the capabilities are, and how important they are. Select **Take a quick tour**.
+1. The Microsoft Defender quick tour introduces you to the security suite, where the capabilities are, and how important they are. Select **Take a quick tour**.
1. Read the short descriptions about what the Microsoft Defender Experts service is and the capabilities it provides. Select **Next**. You see the welcome page:
- 
+ 
## Tell us who to contact for important matters
-Defender Experts for Hunting lets you set up **Notification contacts**. These contacts are the individuals or groups within your organization that Microsoft needs to notify if there are critical incidents or service updates:
+Defender Experts Hunting lets you set up **Notification contacts**. These contacts are the individuals or groups within your organization that Microsoft needs to notify if there are critical incidents or service updates:
- **Incident notification contacts** – These contacts are persons or teams that Microsoft can notify for any critical incidents or hunting clarifications that require immediate response.
@@ -65,7 +65,7 @@ The Defender Experts Notifications service includes:
The following screenshot shows a sample Defender Experts Notification:
-
+
### Where to find Defender Experts Notifications
@@ -74,8 +74,8 @@ You can receive Defender Experts Notifications from Defender Experts through the
- The Defender portal's [Incidents](https://security.microsoft.com/incidents) page
- The Defender portal's [Alerts](https://security.microsoft.com/alerts) page
- OData alerting [Get alerts API](/defender-endpoint/api/get-alerts) and [SIEM integration REST API](/defender-endpoint/configure-siem)
-- [DeviceAlertEvents](advanced-hunting-migrate-from-mde.md#map-devicealertevents-table) table in Advanced hunting
-- Your email if you [configure an email notifications rule](onboarding-defender-experts-for-hunting.md#set-up-defender-experts-email-notifications)
+- [DeviceAlertEvents](../advanced-hunting-migrate-from-mde.md#map-devicealertevents-table) table in Advanced hunting
+- Your email if you [configure an email notifications rule](defender-experts-hunting-onboarding.md#set-up-defender-experts-email-notifications)
- Your Microsoft Teams if you [set up Defender Experts Teams notifications](#set-up-defender-experts-teams-notifications)
### Filter to view just the Defender Experts Notifications
@@ -83,17 +83,17 @@ You can receive Defender Experts Notifications from Defender Experts through the
You can filter your incidents and alerts if you want to only see the Defender Experts Notifications among the many alerts. To filter incidents and alerts to show only Defender Experts Notifications:
1. On the navigation menu, go to **Incidents & alerts** > **Incidents** > select the  icon.
-1. Scroll down to **Service/detection sources** then select the **Microsoft Defender Experts** checkboxes under *Microsoft Defender for Endpoint* and *Microsoft Defender XDR*.
+1. Scroll down to **Service/detection sources** then select the **Microsoft Defender Experts** checkboxes under *Microsoft Defender for Endpoint* and *Microsoft Defender*.
1. Select **Apply**.
### Set up Defender Experts email notifications
-You can set up Microsoft Defender XDR to notify you or your staff by using an email about new incidents or updates to existing incidents, including those observed by Microsoft Defender Experts. [Learn more about getting incident notifications by email](m365d-notifications-incidents.md).
+You can set up Microsoft Defender to notify you or your staff by using an email about new incidents or updates to existing incidents, including those observed by Microsoft Defender Experts. [Learn more about getting incident notifications by email](../m365d-notifications-incidents.md).
-1. In the Microsoft Defender XDR navigation pane, select **Settings** > **Microsoft Defender XDR** > **Email notifications** > **Incidents**.
-1. Update your existing email notification rules or create a new one. For more information, see [Auditing](auditing.md).
+1. In the Microsoft Defender navigation pane, select **Settings** > **Microsoft Defender** > **Email notifications** > **Incidents**.
+1. Update your existing email notification rules or create a new one. For more information, see [Auditing](defender-experts-mdr-auditing.md).
1. On the rule's **Notification settings** page, make sure to configure the following values:
- - **Source** – Choose **Microsoft Defender Experts** under **Microsoft Defender XDR** and **Microsoft Defender for Endpoint**.
+ - **Source** – Choose **Microsoft Defender Experts** under **Microsoft Defender** and **Microsoft Defender for Endpoint**.
- **Alert severity** – Choose the alert severities that trigger an incident notification. For example, if you only want to be informed about high-severity incidents, select High.
### Set up Defender Experts Teams notifications
@@ -124,19 +124,19 @@ When Teams notifications are enabled:
After setup, the system creates the Defender Experts team and the **Hunting notifications** channel, and provides a link to open the Teams channel. A welcome message appears in Teams confirming the setup is complete.
> [!TIP]
-> If the setup fails, see [Configuring the Microsoft Defender Experts app in Teams](teams-restrictions-dexapp.md) for troubleshooting guidance.
+> If the setup fails, see [Configuring the Microsoft Defender Experts app in Teams](defender-experts-teams-app-permissions.md) for troubleshooting guidance.
### Generate sample Defender Experts Notifications
-You can generate a sample Defender Experts Notification to start experiencing the Defender Experts for Hunting service without waiting for an actual critical activity in your environment. By generating a sample notification, you can also test any [email notifications](#set-up-defender-experts-email-notifications) configured in the Microsoft Defender portal for this service. You can also test the configuration of playbooks (if configured for such notifications) and rules in your Security Information and Event Management (SIEM) environment.
+You can generate a sample Defender Experts Notification to start experiencing the Defender Experts Hunting service without waiting for an actual critical activity in your environment. By generating a sample notification, you can also test any [email notifications](#set-up-defender-experts-email-notifications) configured in the Microsoft Defender portal for this service. You can also test the configuration of playbooks (if configured for such notifications) and rules in your Security Information and Event Management (SIEM) environment.
A sample Defender Experts Notification appears in your **Incidents** page with the title *Defender Experts: Test Notification from Microsoft Defender Experts*. The notification's title, summary, and recommendations are placeholder text, while the other elements such as alerts are randomly generated from events present in your tenant and aren't actually impacted.
-:::image type="content" source="./media/onboarding-defender-experts-for-hunting/sample-den-dexh.png" alt-text="Screenshot of a sample Defender Experts Notification in the Incidents page for Defender Experts for Hunting." lightbox="./media/onboarding-defender-experts-for-hunting/sample-den-dexh.png":::
+:::image type="content" source="./media/onboarding-defender-experts-for-hunting/sample-den-dexh.png" alt-text="Screenshot of a sample Defender Experts Notification in the Incidents page for Defender Experts Hunting." lightbox="./media/onboarding-defender-experts-for-hunting/sample-den-dexh.png":::
**To generate a sample notification:**
-1. In your Microsoft Defender XDR navigation pane, go to **Settings** > **Defender Experts** and then select **Sample notifications**.
+1. In your Microsoft Defender navigation pane, go to **Settings** > **Defender Experts** and then select **Sample notifications**.
1. Select **Generate a sample notification**. A green status message appears, confirming that your sample notification is ready for review.
1. Under **Recently generated Defender Experts Notification**, select a link from the list to view its corresponding generated sample notification. The most recent sample appears at the top of the list. Selecting a link redirects you to the **Incidents** page.
@@ -144,6 +144,6 @@ A sample Defender Experts Notification appears in your **Incidents** page with t
## Next step
-- [Access Defender Experts Notifications using Microsoft Graph security API](access-den-graph-api.md)
+- [Access Defender Experts Notifications using Microsoft Graph security API](defender-experts-hunting-graph-api.md)
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/defender-experts/defender-experts-hunting-overview.md b/defender-xdr/defender-experts/defender-experts-hunting-overview.md
new file mode 100644
index 00000000000..6ff14225c2d
--- /dev/null
+++ b/defender-xdr/defender-experts/defender-experts-hunting-overview.md
@@ -0,0 +1,54 @@
+---
+title: What is Microsoft Defender Experts Hunting offering
+ms.reviewer:
+description: Microsoft Defender Experts Hunting is a proactive threat hunting service that goes beyond the endpoint to hunt across endpoints
+ms.service: defender-experts-for-hunting
+ms.author: pauloliveria
+author: poliveria
+ms.localizationpriority: medium
+ms.collection:
+ - m365-security
+ - tier1
+ - essentials-overview
+ms.topic: overview
+ms.custom:
+- cx-ti
+- cx-ean
+ms.date: 08/01/2025
+---
+
+# Microsoft Defender Experts Hunting
+
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/microsoft-defender.md)]
+
+**Applies to:**
+
+- [Microsoft Defender](../microsoft-365-defender.md)
+
+> [!IMPORTANT]
+> Microsoft Defender Experts Hunting is sold separately from other Microsoft Defender products. If you're a Microsoft Defender customer and are interested in purchasing Microsoft Defender Experts Hunting - XDR or Microsoft Defender Experts Hunting - Servers, complete this [customer interest form](https://aka.ms/DEX4HuntingCustomerInterestForm).
+
+> [!NOTE]
+> Any incident response services offered by Defender Experts will be offered under the Defender Experts Service Terms.
+
+Microsoft Defender Experts Hunting was created for customers who have a robust security operations center but want Microsoft to help them proactively hunt threats using Microsoft Defender data:
+
+- **Microsoft Defender Experts Hunting - XDR** is a proactive threat hunting service that goes beyond the endpoint to hunt across endpoints, Microsoft 365, cloud applications, and identity
+- **Microsoft Defender Experts Hunting - Servers** is a proactive threat hunting service for hybrid and multicloud servers
+
+Our experts will investigate anything they find, then hand off the contextual alert information along with remediation instructions, so you can quickly respond.
+
+The following capabilities included in this managed threat hunting service could also help with your daily SecOps work:
+
+- **Threat hunting and analysis** – Defender Experts Hunting look deeper to expose advanced threats and identify the scope and impact of malicious activity associated with human adversaries or hands-on-keyboard attacks.
+- **Defender Experts Notifications** – Notifications show up as incidents in Microsoft Defender, helping to improve your security operations' incident response with specific information about the scope, method of entry, and remediation instructions.
+- **Ask Defender Experts** – Select [**Ask Defender Experts**](defender-experts-hunting-ask-experts.md) in the Microsoft Defender portal to get expert advice about threats your organization is facing. You can ask for help on a specific incident, nation-state actor, or attack vector-related notifications.
+- **Hunter-trained AI** – Our Defender Experts Hunting share their learning back into the automated tools they use to improve threat discovery and prioritization.
+- **Reports** – An interactive report summarizing what we hunted and what we found.
+
+[Watch this short video](https://youtu.be/4t1JgE0X0jc) to learn more about how Microsoft Defender Experts Hunting can help you track the latest advanced threats in your environment.
+
+### Next step
+
+- [Before you begin using Defender Experts Hunting](defender-experts-hunting-prerequisites.md)
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/defender-experts/defender-experts-hunting-prerequisites.md b/defender-xdr/defender-experts/defender-experts-hunting-prerequisites.md
new file mode 100644
index 00000000000..8a039fd588d
--- /dev/null
+++ b/defender-xdr/defender-experts/defender-experts-hunting-prerequisites.md
@@ -0,0 +1,145 @@
+---
+title: Before you begin using the Microsoft Defender Experts Hunting service
+ms.reviewer:
+description: Review the prerequisites for Microsoft Defender Experts Hunting, including required licensing, onboarding, and setup steps before you begin using the service.
+ms.service: defender-experts-for-hunting
+ms.author: pauloliveria
+author: poliveria
+ms.localizationpriority: medium
+ms.collection:
+ - m365-security
+ - m365initiative-defender-endpoint
+ - tier1
+ - essentials-compliance
+ms.topic: how-to
+ms.custom:
+- msecd-doc-authoring-1014
+- cx-ti
+- cx-ean
+ms.date: 06/16/2026
+ai-usage: ai-assisted
+---
+
+# Before you begin using Defender Experts Hunting
+
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/microsoft-defender.md)]
+
+**Applies to:**
+
+- [Microsoft Defender](../microsoft-365-defender.md)
+
+[Microsoft Defender Experts Hunting](defender-experts-hunting-overview.md) is a managed service that provides hunting capabilities for novel emerging threats that aren't yet well known in the industry. The analysts for the hunting service review trends in the threat actor evolution based on world-renowned Microsoft Threat Intelligence and Research. They then apply the insights they gather to hunt for emerging attack vectors within the customer ecosystem.
+
+With deep product expertise powered by threat intelligence, we're uniquely positioned to help you:
+
+1. Focus on novel threat actor evolution in the context of your ecosystem.
+1. Get detailed, step-by-step, and actionable guidance from our experts so you can respond to these emerging threats.
+1. [Seek assistance](#ask-defender-experts) from Defender Experts.
+
+This document outlines the key infrastructure requirements you must meet and important information on data access and compliance you must know before purchasing the **Microsoft Defender Experts Hunting - XDR** service and its add-on, **Microsoft Defender Experts Hunting - Servers**. Microsoft understands that customers who use our managed services entrust us with their most valued asset, their data.
+
+## Eligibility and licensing
+
+Defender Experts Hunting is a separate service from your existing Microsoft Defender products. Before enrolling in this service, make sure that you have the necessary license and access.
+
+**Microsoft Defender Experts Hunting – XDR**
+
+We require the following licensing prerequisites to enable us to get started with this threat hunting service:
+
+- Microsoft Defender for Endpoint P2 must be licensed and enabled on eligible devices
+- Microsoft Defender Antivirus must be licensed and enabled in active mode on devices onboarded to Defender for Endpoint (required for endpoint detection)
+
+The following products are also eligible to get Defender Experts Hunting coverage, and you must have their appropriate product licenses to get started with the service:
+
+- Microsoft Defender for Office 365 P2
+- Microsoft Defender for Identity
+- Microsoft Defender for Cloud Apps
+- Microsoft Entra ID P2
+
+The following product is **not** covered by this service:
+
+- Microsoft Defender for IoT
+- Other Microsoft services not mentioned in the previous lists
+
+**Microsoft Defender Experts Hunting - Servers**
+
+Customers who wish to have Defender Experts Hunting coverage for Microsoft Defender for Cloud servers must have the following:
+
+- Defender Experts Hunting - XDR service enrollment
+- Defender for Servers Plan 1 or Plan 2 in Microsoft Defender for Cloud
+
+> [!NOTE]
+> You can't purchase Defender Experts Hunting for partial coverage. You must apply it at the tenant level. All identities and devices are automatically included.
+
+### Defender Experts Hunting coverage
+
+**Microsoft Defender Experts Hunting – XDR**
+
+Defender Experts Hunting - XDR relies on event signals from Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, Defender for Identity. It also relies on proprietary Microsoft Threat Intelligence sources.
+
+This service also covers servers that have Defender for Endpoint deployed on them with a **Microsoft Defender for Endpoint for Servers** license.
+
+Any detection that's not from Microsoft Defender products (for example, detections from other security vendors) isn't within the scope of Defender Experts Hunting.
+
+**Microsoft Defender Experts Hunting - Servers**
+
+Defender Experts Hunting – Servers provides add-on server coverage, including hybrid and multicloud servers from Defender for Servers.
+
+### Ask Defender Experts
+
+[Ask Defender Experts](defender-experts-hunting-ask-experts.md) is intended to provide a better understanding of complex threats affecting your organization. It focuses on products included in Microsoft Defender Experts services. [See sample questions you can ask Defender Experts](defender-experts-hunting-ask-experts.md#sample-questions-you-can-ask-from-defender-experts).
+
+Defender Experts Hunting customers are assigned 10 Ask Defender Experts credits, which you can use to submit questions, at the start of each calendar quarter. Unused credits from the current quarter roll up to the next one. You can use up to 20 credits only per quarter. All unused credits expire by the end of the calendar year or at the end of your subscription term, whichever comes first.
+
+[Learn more about Microsoft's commercial licensing terms](https://www.microsoft.com/licensing/terms/productoffering/Microsoft365/MCA)
+
+## Access requirements
+
+Anyone from your organization can [apply for the Defender Experts Hunting service](#apply-for-microsoft-defender-experts-hunting-service). However, you need to work with your Commercial Executive to transact the SKU.
+
+You might need certain roles and permissions to fully access the service capabilities. Refer to [Custom roles in role-based access control for Microsoft Defender](../custom-roles.md) for details.
+
+## Service availability and data protection
+
+Defender Experts Hunting - XDR and Defender Experts Hunting - Servers are managed threat hunting services that proactively hunt for threats across endpoints, email, identity, cloud apps, and servers. To carry out hunting on your behalf, Microsoft experts need access to your Microsoft Defender advanced hunting data. Enrolling in this service means you're granting permission to Microsoft experts to access the said data.
+
+The following sections enumerate additional information about the service's data usage, compliance, and availability. For more information about Microsoft's commitment in valuing and protecting your data, visit the [Trust Center](https://www.microsoft.com/trust-center/product-overview) then scroll down to **Additional products and services** > **Managed Security Services** > **Microsoft Defender Experts**.
+
+### Data collection, usage, and retention
+
+All data used for hunting from existing Defender services will continue to reside in the customer's original Microsoft Defender service storage location. [Learn more](/microsoft-365/enterprise/o365-data-locations)
+
+Defender Experts Hunting operational data, such as case tickets and analyst notes, are generated and stored in a Microsoft data center in the EU region for customers whose Defender data is in scope of European Union data boundary and in the US region for other customers, for the length of the service, irrespective of the Microsoft Defender service storage location. Data generated for the reporting dashboard is stored in customer's Microsoft Defender service storage location. Reporting data and operational data will be retained for a grace period of no more than 90 days after a customer's subscription expires. If the customer terminates their subscription, data will be deleted within 30 days.
+
+Microsoft experts hunt over [advanced hunting logs](../advanced-hunting-schema-tables.md) in Microsoft Defender advanced hunting tables. The data in these tables depend on the set of Defender services the customer is enabled for (for example, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Microsoft Entra ID). Experts also use a large set of internal threat intelligence data to inform their hunting and automation.
+
+> [!NOTE]
+> Microsoft Defender for Cloud is integrated with Microsoft Defender. This integration allows security teams to access Defender for Cloud alerts and incidents within the Microsoft Defender portal. The Defender Experts Hunting - Servers add-on service accesses data through the Defender portal, so the same data collection, usage, and retention policies apply to this service.
+
+### Security and compliance
+
+When you purchase and onboard to Defender Experts Hunting, you're granting permission to Microsoft experts to access your advanced hunting data.
+
+### Availability
+
+This service is available worldwide for customers in our commercial public clouds. It's currently not available to customers in government and sovereign clouds.
+
+### Languages
+
+This service is currently delivered in English language only.
+
+## Apply for Microsoft Defender Experts Hunting service
+
+You can apply for the Defender Experts Hunting by performing the following steps:
+
+1. Complete the [customer interest form](https://aka.ms/DEX4HuntingCustomerInterestForm).
+2. Enter your name, company name, and company email ID.
+3. Select **Submit**. Someone from our sales team will reach out within five business days.
+
+### Next step
+
+Continue to the following article to start using Defender Experts Hunting:
+
+- [Start using Defender Experts Hunting](defender-experts-hunting-onboarding.md)
+
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/defender-experts-report.md b/defender-xdr/defender-experts/defender-experts-hunting-report.md
similarity index 70%
rename from defender-xdr/defender-experts-report.md
rename to defender-xdr/defender-experts/defender-experts-hunting-report.md
index a945831b95f..9aaa05dae2c 100644
--- a/defender-xdr/defender-experts-report.md
+++ b/defender-xdr/defender-experts/defender-experts-hunting-report.md
@@ -1,7 +1,7 @@
---
-title: Understand the Defender Experts for Hunting report in Microsoft Defender
+title: Understand the Defender Experts Hunting report in Microsoft Defender
ms.reviewer:
-description: The Defender Experts for Hunting service publishes reports to help you understand all the threats the hunting service surfaced in your environment
+description: The Defender Experts Hunting service publishes reports to help you understand all the threats the hunting service surfaced in your environment
ms.service: defender-experts-for-hunting
ms.author: pauloliveria
author: poliveria
@@ -17,33 +17,33 @@ ms.topic: concept-article
ms.date: 04/16/2026
---
-# Understand the Defender Experts for Hunting report in Microsoft Defender
+# Understand the Defender Experts Hunting report in Microsoft Defender
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/microsoft-defender.md)]
**Applies to:**
-- [Microsoft Defender XDR](microsoft-365-defender.md)
+- [Microsoft Defender](../microsoft-365-defender.md)
-Microsoft Defender Experts for Hunting combines human intelligence with expert-trained technology to help Microsoft Defender XDR customers understand the significant threats they face. It highlights how Defender Experts' threat hunting skills, thorough understanding of the threat landscape, and knowledge of emerging threats can help you identify, prioritize, and address those threats in your environment.
+Microsoft Defender Experts Hunting combines human intelligence with expert-trained technology to help Microsoft Defender customers understand the significant threats they face. It highlights how Defender Experts' threat hunting skills, thorough understanding of the threat landscape, and knowledge of emerging threats can help you identify, prioritize, and address those threats in your environment.
-The Defender Experts for Hunting service generates reports to help you understand all the threats the hunting service surfaced in your environment, alongside the alerts generated by your Microsoft Defender XDR products. You can view the report in the current (running) month, or in one-, three-, or six-month periods.
+The Defender Experts Hunting service generates reports to help you understand all the threats the hunting service surfaced in your environment, alongside the alerts generated by your Microsoft Defender products. You can view the report in the current (running) month, or in one-, three-, or six-month periods.
To view the report in your Microsoft Defender portal, go to **Reports**, select **Defender Experts** > **Hunting report**. Each section of the report is designed to provide more insights into the threats and suspicious activities our Defender Experts found in your environment.
Refer to the following screenshot of a sample report:
-:::image type="content" source="media/defender-experts-report/defender-experts-hunting-report.png" alt-text="Screenshot of Defender Experts for hunting report." lightbox="media/defender-experts-report/defender-experts-hunting-report.png":::
+:::image type="content" source="media/defender-experts-report/defender-experts-hunting-report.png" alt-text="Screenshot of Defender Experts Hunting report." lightbox="media/defender-experts-report/defender-experts-hunting-report.png":::
## Identify prevalent threats and other potential attack entry points
-Signals from Microsoft Defender XDR and investigations by Defender Experts for Hunting help identify suspicious activities in your environment. Significant threat activities have corresponding [Defender Experts Notifications](onboarding-defender-experts-for-hunting.md#receive-defender-experts-notifications), which also provide recommendations to remediate and defend your organization.
+Signals from Microsoft Defender and investigations by Defender Experts Hunting help identify suspicious activities in your environment. Significant threat activities have corresponding [Defender Experts Notifications](defender-experts-hunting-onboarding.md#receive-defender-experts-notifications), which also provide recommendations to remediate and defend your organization.
The top section of the report provides you with the total number of hunts, suspicious threats investigated, and Defender Experts Notifications our experts sent for your chosen period:
:::image type="content" source="media/defender-experts-report/report-top-section-dens.png" alt-text="Screenshot of the top section of the report showing the number of threats identified." lightbox="media/defender-experts-report/report-top-section-dens.png":::
-To view these notifications, select **View Defender Experts Notifications**. This action redirects you to the Microsoft Defender portal **Incidents** page. Defender Experts for Hunting alerts or Defender Experts Notifications have the **Defender Experts** tag.
+To view these notifications, select **View Defender Experts Notifications**. This action redirects you to the Microsoft Defender portal **Incidents** page. Defender Experts Hunting alerts or Defender Experts Notifications have the **Defender Experts** tag.
> [!NOTE]
> The **View Defender Experts Notifications** button only appears if the number of threats identified is at least 1.
@@ -58,7 +58,7 @@ All other identified activities are visualized or summarized in the following se
The **Hunt trend** section displays a trendline chart of the number of hunting activities Defender Experts conducted in your environment for your chosen time period. This chart gives you visibility of the continuous monitoring and investigation our experts are doing even if they don't find any active threats or suspicious activities.
-:::image type="content" source="media/defender-experts-report/hunting-report-hunt-trend.png" alt-text="Screenshot of the Hunt trend section of the Defender Experts for Hunting report." lightbox="media/defender-experts-report/hunting-report-hunt-trend.png":::
+:::image type="content" source="media/defender-experts-report/hunting-report-hunt-trend.png" alt-text="Screenshot of the Hunt trend section of the Defender Experts Hunting report." lightbox="media/defender-experts-report/hunting-report-hunt-trend.png":::
### Emerging threats
@@ -67,7 +67,7 @@ The **Emerging threats** section details the proactive, hypothesis-based hunts w
This section is a table that shows the threat title, whether we identified impact in your environment, the threat's severity, and threat category. It aggregates our hunts for emerging threats based on their severity. You can filter this section by the hunts' severity and threat category.
-:::image type="content" source="media/defender-experts-report/hunting-report-emerging-threats.png" alt-text="Screenshot of the Emerging threats section of the Defender Experts for Hunting report." lightbox="media/defender-experts-report/hunting-report-emerging-threats.png":::
+:::image type="content" source="media/defender-experts-report/hunting-report-emerging-threats.png" alt-text="Screenshot of the Emerging threats section of the Defender Experts Hunting report." lightbox="media/defender-experts-report/hunting-report-emerging-threats.png":::
Selecting one of the threat titles opens a side panel with its [hunting summary](#hunting-summaries), which summarizes our findings about the threat. Hunting summaries give you insight into our investigations and keep you updated with the threat landscape.
@@ -75,7 +75,7 @@ Selecting one of the threat titles opens a side panel with its [hunting summary]
The **Hunts by threat category** section displays hunting activity tiles that are sorted according to their threat categories. This sorting helps you visualize what an activity is trying to achieve in each attack phase so you can plan the corresponding containment and remediation actions.
-:::image type="content" source="media/defender-experts-report/threat-categories-filter.png" alt-text="Screenshot of the Hunts by threat category section of the Defender Experts for Hunting report showing the dropdown menu." lightbox="media/defender-experts-report/threat-categories-filter.png":::
+:::image type="content" source="media/defender-experts-report/threat-categories-filter.png" alt-text="Screenshot of the Hunts by threat category section of the Defender Experts Hunting report showing the dropdown menu." lightbox="media/defender-experts-report/threat-categories-filter.png":::
You can filter the activities displayed in the table by choosing any of the following options in the dropdown menu:
@@ -93,6 +93,6 @@ Each hunt that Defender Experts conduct tells a story, even when they don't find
When you select one of the threat titles in the **Emerging threats** section or one of the activity tiles with the scroll icon in the **Hunts by threat category** section, a side panel opens that displays the **hunting summary**, or summary of the investigation related to the threat or activity: what the Defender Experts hunted for, why they hunted for it, and how they reached their final determination. The summary also provides the dates and times the hunt started and concluded, the hunt classification, and impacted assets. If applicable, it also provides links to view related Defender Experts Notifications.
-:::image type="content" source="media/defender-experts-report/hunting-report-hunt-summary.png" alt-text="Screenshot of a hunting summary in the Defender Experts for Hunting report." lightbox="media/defender-experts-report/hunting-report-hunt-summary.png":::
+:::image type="content" source="media/defender-experts-report/hunting-report-hunt-summary.png" alt-text="Screenshot of a hunting summary in the Defender Experts Hunting report." lightbox="media/defender-experts-report/hunting-report-hunt-summary.png":::
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/auditing.md b/defender-xdr/defender-experts/defender-experts-mdr-auditing.md
similarity index 92%
rename from defender-xdr/auditing.md
rename to defender-xdr/defender-experts/defender-experts-mdr-auditing.md
index 651746bff51..0bc6f5282e2 100644
--- a/defender-xdr/auditing.md
+++ b/defender-xdr/defender-experts/defender-experts-mdr-auditing.md
@@ -19,12 +19,12 @@ ms.date: 06/16/2026
ai-usage: ai-assisted
---
-# Audit Defender Experts actions and administrator changes in Microsoft Defender XDR
+# Audit Defender Experts actions and administrator changes in Microsoft Defender
**Applies to:**
-- [Microsoft Defender Experts for XDR](dex-xdr-overview.md)
-- [Microsoft Defender Experts for Servers](dex-servers-overview.md)
+- [Microsoft Defender Experts MDR](defender-experts-mdr-overview.md)
+- [Microsoft Defender Experts for Servers](defender-experts-servers-overview.md)
As a tenant administrator, you can use Microsoft Purview to search the audit logs for the times Microsoft Defender Experts signed into your tenant and the actions they did there to perform their investigations. You can also search the audit logs for the changes done by your tenant administrators to the Defender Experts settings.
@@ -72,5 +72,5 @@ In addition to using Audit New Search in the Microsoft Purview portal, you can u
## See also
-- For prerequisites, limitations, and other guidance, see [Important considerations for Microsoft Defender Experts](additional-information-xdr.md).
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
+- For prerequisites, limitations, and other guidance, see [Important considerations for Microsoft Defender Experts](defender-experts-mdr-considerations.md).
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/communicate-defender-experts-xdr.md b/defender-xdr/defender-experts/defender-experts-mdr-communication.md
similarity index 84%
rename from defender-xdr/communicate-defender-experts-xdr.md
rename to defender-xdr/defender-experts/defender-experts-mdr-communication.md
index 60dec52d9fd..ac5b65bca41 100644
--- a/defender-xdr/communicate-defender-experts-xdr.md
+++ b/defender-xdr/defender-experts/defender-experts-mdr-communication.md
@@ -21,14 +21,14 @@ ms.date: 03/16/2026
**Applies to:**
-- [Microsoft Defender Experts for XDR](dex-xdr-overview.md)
-- [Microsoft Defender Experts for Servers](dex-servers-overview.md)
+- [Microsoft Defender Experts MDR](defender-experts-mdr-overview.md)
+- [Microsoft Defender Experts for Servers](defender-experts-servers-overview.md)
The Microsoft Defender Experts service provides you with multiple channels of communication to discuss incidents with our experts, ask them questions on demand, or get service readiness or operations support from your Security Delivery Experts (SDXs), if included in your service.
## Incident and managed response notifications
-When an incident requires your attention, such as the incidents our experts issue [managed response actions](managed-detection-and-response-xdr.md), you receive notifications through one or more of the following channels:
+When an incident requires your attention, such as the incidents our experts issue [managed response actions](defender-experts-mdr-managed-response.md), you receive notifications through one or more of the following channels:
### In-portal chat
@@ -47,9 +47,9 @@ To leave feedback about your chat experience, select the **thumbs up** or **thum
### Teams chat
-Apart from using the in-portal chat, you can also engage in real-time chat conversations with Defender Experts directly within Microsoft Teams. This capability provides you and your security operations center (SOC) team more flexibility when responding to incidents that require managed response. [Learn more about turning on notifications and chat on Teams](get-started-xdr.md#receive-managed-response-notifications-and-updates-in-microsoft-teams).
+Apart from using the in-portal chat, you can also engage in real-time chat conversations with Defender Experts directly within Microsoft Teams. This capability provides you and your security operations center (SOC) team more flexibility when responding to incidents that require managed response. [Learn more about turning on notifications and chat on Teams](defender-experts-mdr-get-started.md#receive-managed-response-notifications-and-updates-in-microsoft-teams).
-Once you turn on chat on Teams, a new team named **Defender Experts team** is created and the Defender Experts Teams app is installed in it. Each incident that requires your attention is posted on this team's **Managed response** channel as a new post. To engage with our experts (for example, ask follow-up questions about the investigation summary or actions published by Defender Experts), use the **Reply** text bar and type your message. If you have issues setting up the Defender Experts channel or tagging @*Defender Experts*, see [troubleshooting Defender Experts app permissions in Microsoft Teams](../defender-xdr/teams-restrictions-dexapp.md).
+Once you turn on chat on Teams, a new team named **Defender Experts team** is created and the Defender Experts Teams app is installed in it. Each incident that requires your attention is posted on this team's **Managed response** channel as a new post. To engage with our experts (for example, ask follow-up questions about the investigation summary or actions published by Defender Experts), use the **Reply** text bar and type your message. If you have issues setting up the Defender Experts channel or tagging @*Defender Experts*, see [troubleshooting Defender Experts app permissions in Microsoft Teams](defender-experts-teams-app-permissions.md).
:::image type="content" source="media/communicate-defender-experts-xdr/teams-chat-managed-response-01.png" alt-text="Screenshot of managed response teams channel." lightbox="media/communicate-defender-experts-xdr/teams-chat-managed-response-01.png":::
@@ -77,18 +77,18 @@ However, our experts can also send emails to your identified notification contac
### Phone call
-In break-glass scenarios or matters that require immediate attention (for example, malware on high-value infrastructure, ransomware, data exfiltration, insider threat, or other signs of a determined human adversary), the experts reach out to your identified **incident notification contacts** by using the details you provided, including calling their listed phone numbers. [Learn more about adding contact persons or groups for incident notifications](get-started-xdr.md#tell-us-who-to-contact-for-important-matters).
+In break-glass scenarios or matters that require immediate attention (for example, malware on high-value infrastructure, ransomware, data exfiltration, insider threat, or other signs of a determined human adversary), the experts reach out to your identified **incident notification contacts** by using the details you provided, including calling their listed phone numbers. [Learn more about adding contact persons or groups for incident notifications](defender-experts-mdr-get-started.md#tell-us-who-to-contact-for-important-matters).
## Ask Defender Experts
-While the previous scenarios involve the experts initiating communication with you, you can also request advanced threat expertise on demand by selecting **Ask Defender Experts** directly inside the Microsoft Defender portal. [Learn more](experts-on-demand.md).
+While the previous scenarios involve the experts initiating communication with you, you can also request advanced threat expertise on demand by selecting **Ask Defender Experts** directly inside the Microsoft Defender portal. [Learn more](defender-experts-hunting-ask-experts.md).
## Collaborating with your Security Delivery Expert
-The Security Delivery Expert (SDX) is responsible for managing the overall relationship for your organization with the Defender Experts for XDR service. They are your trusted advisor working along with XDR experts' team to help you protect your organization.
+The Security Delivery Expert (SDX) is responsible for managing the overall relationship for your organization with the Defender Experts MDR service. They are your trusted advisor working along with XDR experts' team to help you protect your organization.
> [!NOTE]
-> Security Delivery Experts are included if your Defender Experts service is licensed for 500 or more seats.
+> Security Delivery Experts are included if your Defender Experts service is licensed for 500 or more devices.
The SDX provides the following services:
@@ -99,12 +99,12 @@ The SDX provides the following services:
- Provide tailored service delivery content and reporting, including periodic business reviews.
- Serve as a single point of contact for feedback and escalations related to Defender Experts Service.
-The SDX engages with your identified **service review contacts**. [Learn more about adding contact persons or groups for service review and delivery](get-started-xdr.md#tell-us-who-to-contact-for-important-matters)
+The SDX engages with your identified **service review contacts**. [Learn more about adding contact persons or groups for service review and delivery](defender-experts-mdr-get-started.md#tell-us-who-to-contact-for-important-matters).
### See also
-- [Get started with Microsoft Defender Experts for XDR](get-started-xdr.md)
-- [Managed detection and response](managed-detection-and-response-xdr.md)
-- [Get real-time visibility with Defender Experts reports](reports-xdr.md)
+- [Get started with Microsoft Defender Experts MDR](defender-experts-mdr-get-started.md)
+- [Managed detection and response](defender-experts-mdr-managed-response.md)
+- [Get real-time visibility with Defender Experts reports](defender-experts-mdr-reports.md)
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/defender-experts/defender-experts-mdr-considerations.md b/defender-xdr/defender-experts/defender-experts-mdr-considerations.md
new file mode 100644
index 00000000000..04c3a385b84
--- /dev/null
+++ b/defender-xdr/defender-experts/defender-experts-mdr-considerations.md
@@ -0,0 +1,47 @@
+---
+title: Important considerations related to Defender Experts MDR
+ms.reviewer:
+description: Additional information and important considerations related to Defender Experts MDR
+ms.service: defender-experts-for-xdr
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: pauloliveria
+author: poliveria
+ms.localizationpriority: medium
+ms.collection:
+ - m365-security
+ - tier1
+ms.topic: article
+ms.custom:
+- cx-ti
+- cx-dex
+ms.date: 03/05/2025
+appliesto:
+ - Microsoft Defender
+---
+
+# Important considerations for Microsoft Defender Experts MDR
+
+**Applies to:**
+
+- [Microsoft Defender](../microsoft-365-defender.md)
+
+To realize the benefits of Microsoft Defender Experts MDR, you and your security operations center (SOC) team must take note of the following considerations to ensure timely incident remediation, improve your organization's security posture, and protect your organization from threats.
+
+- **Engage actively through the readiness assessment process** – The [readiness assessment](defender-experts-mdr-get-started.md#prepare-your-environment-for-the-defender-experts-service) when onboarding for Defender Experts MDR is an integral part of the offering. Completing it successfully ensures prompt service coverage and protects your organization against known threats.
+- **Act on managed responses in a timely manner** – For any suspicious incidents and alerts, our experts provide a detailed investigation summary and managed responses for remediation. We expect your SOC team to act on these managed responses in a timely manner to prevent further impact from any malicious attempts.
+- **Configure recommended settings and follow best practices to improve security posture** – As part of our service, we will share ongoing recommendations to strengthen your security posture. These recommendations are based on incidents investigated in your organization. Your SOC team should review these recommendations and implement them as soon as possible to protect your organization against future threats.
+
+### Note about incident response
+
+Defender Experts MDR isn't an incident response (IR) service. While it augments your SOC team to triage, investigate, and remediate threats, Defender Experts MDR won't be able to provide recovery and crisis management services **if a major security incident has already occurred** in your organization. You should engage instead with your own security IR provider to address urgent incident response issues.
+
+If you don't have your own security IR team, [Microsoft Defender Experts Cybersecurity Incident Response](https://www.microsoft.com/security/business/microsoft-incident-response) can help mitigate a breach and recover your operations. If you're an existing unified or premier support customer, create a support request in the [Microsoft Services Hub](https://serviceshub.microsoft.com/home) to engage with them. Otherwise, fill out the [Experiencing a Cybersecurity Incident?](https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbRypQlJUvhTFIvfpiAfrpFQdUOTdRRFpDUFQ1TzNLVFZXV0VUOVlVN0szUiQlQCN0PWcu) form. We'll review the details and quickly call you with instructions to get started.
+
+### See also
+
+- [General information on Defender Experts MDR service](defender-experts-mdr-faq.md)
+- [How Microsoft Defender Experts MDR permissions work](defender-experts-mdr-permissions.md)
+
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/faq-managed-response.md b/defender-xdr/defender-experts/defender-experts-mdr-faq-managed-response.md
similarity index 59%
rename from defender-xdr/faq-managed-response.md
rename to defender-xdr/defender-experts/defender-experts-mdr-faq-managed-response.md
index 86ccc3cbe93..a616f7887e1 100644
--- a/defender-xdr/faq-managed-response.md
+++ b/defender-xdr/defender-experts/defender-experts-mdr-faq-managed-response.md
@@ -1,5 +1,5 @@
---
-title: FAQs related to Microsoft Defender Experts for XDR Managed response
+title: FAQs related to Microsoft Defender Experts MDR Managed response
ms.reviewer:
description: Frequently asked questions related to managed response notifications
ms.service: defender-experts-for-xdr
@@ -22,19 +22,19 @@ ms.date: 04/30/2026
**Applies to:**
-- [Microsoft Defender XDR](microsoft-365-defender.md)
+- [Microsoft Defender](../microsoft-365-defender.md)
-This article lists questions you or your SOC team might have regarding [Managed response](managed-detection-and-response-xdr.md).
+This article lists questions you or your SOC team might have regarding [Managed response](defender-experts-mdr-managed-response.md).
## General information
| Questions | Answers |
|---------|---------|
-|**What is Managed response?** | Microsoft Defender Experts for XDR offers **Managed response** where the experts manage the entire remediation process for incidents that require them. This process includes investigating the incident to identify the root cause, determining the required response actions, and taking those actions on your behalf.|
+|**What is Managed response?** | Microsoft Defender Experts MDR offers **Managed response** where the experts manage the entire remediation process for incidents that require them. This process includes investigating the incident to identify the root cause, determining the required response actions, and taking those actions on your behalf.|
|**What actions are in scope for Managed response?** | All actions found below are in scope for Managed response for any device and user that isn't excluded.
*For devices*- Isolate machine
- Release machine from isolation
- Stop and quarantine file
- Restrict app execution
- Remove app restriction
*For users*- Disable user
- Enable user
- Soft-delete emails
-|**Can I customize the extent of Managed response?** | You can configure the extent to which our experts do Managed response actions on your behalf by excluding certain devices and users (individually or by groups) either during onboarding or later by modifying your service's settings. [Read more about excluding device groups](get-started-xdr.md#exclude-devices-and-users-from-remediation) |
+|**Can I customize the extent of Managed response?** | You can configure the extent to which our experts do Managed response actions on your behalf by excluding certain devices and users (individually or by groups) either during onboarding or later by modifying your service's settings. [Read more about excluding device groups](defender-experts-mdr-get-started.md#exclude-devices-and-users-from-remediation). |
|**What support do Defender Experts offer for excluded assets?** | If the experts determine that you need to perform response actions on excluded devices or users, they notify you through various customizable methods and direct you to your Microsoft Defender portal. From your portal, you can view a detailed summary of the investigation process and the required response actions in the portal and perform these required actions directly. Similar capabilities are also available through Defender APIs, in case you prefer using a security information and event management (SIEM), IT service management (ITSM), or any other third-party tool. |
-|**How am I going to be informed about the response actions?** | Response actions that the experts complete on your behalf and any pending ones that you need to perform on your excluded assets are displayed in the **Managed response** panel in your Defender portal's **Incidents** page.
In addition, you receive an email containing a link to the incident and instructions to view the Managed response in the portal. Moreover, if you have integration with Microsoft Sentinel or APIs, you also receive notifications within those tools by looking for Defender Experts statuses. For more information, see [FAQs related to Microsoft Defender Experts for XDR incident notifications](faq-incident-notifications-xdr.md).|
+|**How am I going to be informed about the response actions?** | Response actions that the experts complete on your behalf and any pending ones that you need to perform on your excluded assets are displayed in the **Managed response** panel in your Defender portal's **Incidents** page.
In addition, you receive an email containing a link to the incident and instructions to view the Managed response in the portal. Moreover, if you have integration with Microsoft Sentinel or APIs, you also receive notifications within those tools by looking for Defender Experts statuses. For more information, see [FAQs related to Microsoft Defender Experts MDR incident notifications](defender-experts-mdr-faq-managed-response.md#understanding-managed-response-notifications).|
|**Can I customize Managed response based on actions?** | No. If you have devices or users that are high-value or sensitive, add them to your exclusion list. The experts don't take any action on them and only provide guidance if they're impacted by an incident.|
## Understanding managed response notifications
@@ -46,8 +46,8 @@ This article lists questions you or your SOC team might have regarding [Managed
| **How do I know whether a Defender Experts analyst has started working on an incident?** | When Defender Experts determine that an incident needs investigation (whether due to the service or detection source involved, severity level, your defined scoped coverage, or other reasons), they update the incident's **Assigned to** field to *Defender Experts*. When the experts start investigating the incident, they update its **Status** field to *In progress*.|
| **How do I know whether a Defender Experts analyst has resolved an incident?** | When a Defender Experts analyst resolves an incident, they update the incident's **Status** field to _Resolved_. |
| **How do I know what conclusion led a Defender Experts analyst to resolve an incident?** | When Defender Experts complete their investigation on an incident, they modify the incident's **Classification** and **Determination** fields and provide an **Investigation summary** in the Managed response flyout panel in your Microsoft Defender portal.|
-| **How do I know what actions a Defender Experts analyst took in my tenant when investigating an incident?** | For each incident they investigate, the Defender Experts analyst summarizes any actions they performed within your tenant in the incident's **Investigation summary** located in the **Managed response** flyout panel in your Microsoft Defender portal.
You can also retrieve information about these actions, and the times they signed into your tenant, by [searching your audit logs](auditing.md) either on the Microsoft Purview portal or through the Office 365 Management Activity API.|
-| **How do I know whether a Defender Experts analyst has sent any response actions for my SOC team?** | The Defender Experts analyst publishes the response actions they recommend your SOC team to perform on an incident in an incident's **Managed response** flyout panel in your Microsoft Defender portal.
At this time, the incident's **Assigned to** field is updated to _Customer_ and its **Status** is updated to _Awaiting Customer Action_.
Your incident contacts, which you have [designated](get-started-xdr.md#tell-us-who-to-contact-for-important-matters) in **Settings** > **Defender Experts** > **Notification contacts** in your Microsoft Defender portal, also receive a corresponding email notification if there are response actions requiring your attention. You also receive a Teams notification if you set it up in **Settings** > **Defender Experts** > **Teams** in your Microsoft Defender portal. |
+| **How do I know what actions a Defender Experts analyst took in my tenant when investigating an incident?** | For each incident they investigate, the Defender Experts analyst summarizes any actions they performed within your tenant in the incident's **Investigation summary** located in the **Managed response** flyout panel in your Microsoft Defender portal.
You can also retrieve information about these actions, and the times they signed into your tenant, by [searching your audit logs](defender-experts-mdr-auditing.md) either on the Microsoft Purview portal or through the Office 365 Management Activity API.|
+| **How do I know whether a Defender Experts analyst has sent any response actions for my SOC team?** | The Defender Experts analyst publishes the response actions they recommend your SOC team to perform on an incident in an incident's **Managed response** flyout panel in your Microsoft Defender portal.
At this time, the incident's **Assigned to** field is updated to _Customer_ and its **Status** is updated to _Awaiting Customer Action_.
Your incident contacts, which you have [designated](defender-experts-mdr-get-started.md#tell-us-who-to-contact-for-important-matters) in **Settings** > **Defender Experts** > **Notification contacts** in your Microsoft Defender portal, also receive a corresponding email notification if there are response actions requiring your attention. You also receive a Teams notification if you set it up in **Settings** > **Defender Experts** > **Teams** in your Microsoft Defender portal. |
| **How do I ask a Defender Experts analyst questions about an investigation or response action?** | After a Defender Experts analyst publishes their investigation summary and recommended response actions in the **Managed response** flyout panel of a True Positive incident, you can use the **Chat** tab in the same panel to ask the Defender Experts team questions about the incident and their investigation.
Alternatively, your designated incident contacts can directly respond to the Teams notification they received from Defender Experts to ask any questions you might have.|
| **How do I know which incidents have pending response actions?** | The Defender Experts card in your Microsoft Defender portal home page includes a link that displays a message (for example, _3 incidents awaiting your action_). Selecting this link directs you to a filtered list of incidents specifically requiring your attention.
You can filter the incident queue in your Microsoft Defender portal by selecting **Assigned to** as _Customer_ or **Status** as _Awaiting Customer Action_.|
@@ -55,29 +55,29 @@ This article lists questions you or your SOC team might have regarding [Managed
| Questions | Answers |
|---------|---------|
-| **How do I get Defender Experts updates in Sentinel?** | If you enable the data connector between Microsoft Defender XDR and Microsoft Sentinel, updates made by Defender Experts in Defender to incidents are synchronized with Microsoft Sentinel. [Learn more](/azure/sentinel/connect-microsoft-365-defender).
The **Assigned to**, **Status**, and **Classification** fields in Microsoft Defender XDR incidents are mapped to the corresponding fields in Sentinel, namely **Owner**, **Status**, and **Reason for closing**.|
-| **How do I get Defender Experts updates in Sentinel to automatically trigger a playbook?** | To get Defender Experts updates, first, set up automation rules in Sentinel that are triggered by the following Defender Experts updates:- When the **Owner** field in Microsoft Sentinel is updated to _Defender Experts_ or _Customer_.
- When the **Status** field in Microsoft Sentinel is updated to _Active_ or _Closed_, which corresponds to Microsoft Defender XDR **Status** _Active_ and _In Progress_ respectively.
- When Sentinel **Tag** _Awaiting Customer Action_ gets added, which corresponds to Microsoft Defender XDR **Status** _Awaiting Customer Action_.
Next, set up playbooks in Microsoft Sentinel to automatically sync incident updates or [send incident notifications into other apps](/azure/sentinel/tutorial-respond-threats-playbook).- Send email, or Teams message, or Slack message to your SOC team when a Defender Experts analyst is assigned to an incident.
- Send SMS or phone call via Azure Communications Services or Twilio connector to your SOC lead when Defender Experts publishes response action for your team.
- Create a task or ticket in apps such as Azure DevOps, ServiceNow, Jira, ZenDesk, FreshService, PagerDuty, etc. for your IT Ops team.
|
+| **How do I get Defender Experts updates in Sentinel?** | If you enable the data connector between Microsoft Defender and Microsoft Sentinel, updates made by Defender Experts in Defender to incidents are synchronized with Microsoft Sentinel. [Learn more](/azure/sentinel/connect-microsoft-365-defender).
The **Assigned to**, **Status**, and **Classification** fields in Microsoft Defender incidents are mapped to the corresponding fields in Sentinel, namely **Owner**, **Status**, and **Reason for closing**.|
+| **How do I get Defender Experts updates in Sentinel to automatically trigger a playbook?** | To get Defender Experts updates, first, set up automation rules in Sentinel that are triggered by the following Defender Experts updates:- When the **Owner** field in Microsoft Sentinel is updated to _Defender Experts_ or _Customer_.
- When the **Status** field in Microsoft Sentinel is updated to _Active_ or _Closed_, which corresponds to Microsoft Defender **Status** _Active_ and _In Progress_ respectively.
- When Sentinel **Tag** _Awaiting Customer Action_ gets added, which corresponds to Microsoft Defender **Status** _Awaiting Customer Action_.
Next, set up playbooks in Microsoft Sentinel to automatically sync incident updates or [send incident notifications into other apps](/azure/sentinel/tutorial-respond-threats-playbook).- Send email, or Teams message, or Slack message to your SOC team when a Defender Experts analyst is assigned to an incident.
- Send SMS or phone call via Azure Communications Services or Twilio connector to your SOC lead when Defender Experts publishes response action for your team.
- Create a task or ticket in apps such as Azure DevOps, ServiceNow, Jira, ZenDesk, FreshService, PagerDuty, etc. for your IT Ops team.
|
| **How can I access managed response actions published by Defender Experts from Sentinel?** | Once Defender Experts publish managed response actions for an incident in your Microsoft Defender portal, the **Owner** field is updated to _Customer_ automatically, and the tag _Awaiting Customer Action_ is available in Sentinel. You can use these field changes as a trigger to review the managed response panel for the corresponding incident in the Microsoft Defender portal.|
### In third-party SIEM, SOAR, or ITSM apps
| Questions | Answers |
|---------|---------|
-| **How do I get Defender Experts updates from Microsoft Defender XDR to sync into third-party security information and event management (SIEM), security orchestration, automation and response (SOAR), or IT service management (ITSM) apps?** | You can get Defender Experts updates from Microsoft Defender XDR through the Graph Security API. For more information, see [Access managed response through Graph API](managed-detection-and-response-xdr.md#access-managed-response-through-graph-api).
To initiate the synchronization process:- Establish the mapping between fields in Microsoft Defender XDR and the corresponding fields in the desired application. Determine whether the sync should be uni- or bi-directional and ensure that the other application supports that.
- Develop, test, and deploy your sync integration. In most cases, it's recommended to periodically poll the Graph Security API every minute or so to check for updates.
- Periodically validate that the field mapping is up to date.
|
+| **How do I get Defender Experts updates from Microsoft Defender to sync into third-party security information and event management (SIEM), security orchestration, automation and response (SOAR), or IT service management (ITSM) apps?** | You can get Defender Experts updates from Microsoft Defender through the Graph Security API. For more information, see [Access managed response through Graph API](defender-experts-mdr-managed-response.md#access-managed-response-through-graph-api).
To initiate the synchronization process:- Establish the mapping between fields in Microsoft Defender and the corresponding fields in the desired application. Determine whether the sync should be uni- or bi-directional and ensure that the other application supports that.
- Develop, test, and deploy your sync integration. In most cases, it's recommended to periodically poll the Graph Security API every minute or so to check for updates.
- Periodically validate that the field mapping is up to date.
|
| **Can I sync managed response actions published by Defender Experts in Microsoft Defender portal to third-party SIEM, SOAR, or ITSM apps?** | Once Defender Experts publish managed response actions for an incident in your Microsoft Defender portal, the **Assigned to** field is changed to _Customer_ and the **Status** field is updated to _Awaiting Customer Action_. You can sync these fields via the Graph Security API and then use these changes as a trigger to review the managed response actions in the Microsoft Defender portal.
Managed response actions are expected to be available in the Graph Security API later this year, at which time it will be possible to sync them with your third-party apps.|
### In other communication services
| Questions | Answers |
|---------|---------|
-| **Can I get Defender Experts updates from Microsoft Defender XDR in email?** | When a Defender Experts analyst publishes recommended response actions to an incident, your designated incident contacts receive an email notification to the email addresses specified in **Settings** > **Defender Experts** > **Notification contacts** in your Microsoft Defender portal.
Additionally, you can [configure a Logic App](/connectors/connector-reference/connector-reference-logicapps-connectors) to send all incident updates to your designated email addresses automatically.|
-| **Can I get Defender Experts updates from Microsoft Defender XDR in Microsoft Teams?** | You can access two-way chat functionality through an incident's **Managed response** flyout panel in your Microsoft Defender portal.
You receive notifications when a Managed response is posted and can engage in real-time chat conversations with Defender Experts directly within Microsoft Teams. [Learn more about setting up Teams](get-started-xdr.md#receive-managed-response-notifications-and-updates-in-microsoft-teams).|
-| **Can I get Defender Experts updates from Microsoft Defender XDR as SMS or phone call updates, or in third-party communications services such as Slack?** | You can [configure a Logic App](/connectors/connector-reference/connector-reference-logicapps-connectors) to send notifications from communication services such as Slack, Twilio, Azure Communication Services, and more.|
+| **Can I get Defender Experts updates from Microsoft Defender in email?** | When a Defender Experts analyst publishes recommended response actions to an incident, your designated incident contacts receive an email notification to the email addresses specified in **Settings** > **Defender Experts** > **Notification contacts** in your Microsoft Defender portal.
Additionally, you can [configure a Logic App](/connectors/connector-reference/connector-reference-logicapps-connectors) to send all incident updates to your designated email addresses automatically.|
+| **Can I get Defender Experts updates from Microsoft Defender in Microsoft Teams?** | You can access two-way chat functionality through an incident's **Managed response** flyout panel in your Microsoft Defender portal.
You receive notifications when a Managed response is posted and can engage in real-time chat conversations with Defender Experts directly within Microsoft Teams. [Learn more about setting up Teams](defender-experts-mdr-get-started.md#receive-managed-response-notifications-and-updates-in-microsoft-teams).|
+| **Can I get Defender Experts updates from Microsoft Defender as SMS or phone call updates, or in third-party communications services such as Slack?** | You can [configure a Logic App](/connectors/connector-reference/connector-reference-logicapps-connectors) to send notifications from communication services such as Slack, Twilio, Azure Communication Services, and more.|
### See also
-- [Managed detection and response](managed-detection-and-response-xdr.md)
-- [FAQs related to Microsoft Defender Experts for XDR incident notifications](faq-incident-notifications-xdr.md)
+- [Managed detection and response](defender-experts-mdr-managed-response.md)
+- [FAQs related to Microsoft Defender Experts MDR incident notifications](defender-experts-mdr-faq-managed-response.md#understanding-managed-response-notifications)
-[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/defender-experts/defender-experts-mdr-faq.md b/defender-xdr/defender-experts/defender-experts-mdr-faq.md
new file mode 100644
index 00000000000..2f5e9cc7690
--- /dev/null
+++ b/defender-xdr/defender-experts/defender-experts-mdr-faq.md
@@ -0,0 +1,43 @@
+---
+title: FAQs related to Microsoft Defender Experts MDR
+ms.reviewer:
+description: Frequently asked questions related to Defender Experts MDR
+ms.service: defender-experts-for-xdr
+ms.author: pauloliveria
+author: poliveria
+ms.localizationpriority: medium
+ms.collection:
+ - m365-security
+ - tier1
+ms.topic: faq
+ms.custom:
+- cx-ti
+- cx-dex
+ms.date: 08/01/2025
+---
+
+# General information on Defender Experts MDR service
+
+**Applies to:**
+
+- [Microsoft Defender](../microsoft-365-defender.md)
+
+| Questions | Answers |
+|---------|---------|
+| **How is Microsoft Defender Experts MDR different from Microsoft Defender Experts Hunting?** | [Microsoft Defender Experts Hunting](defender-experts-hunting-overview.md) provides proactive threat hunting service to proactively find threats. This service is meant for customers that have a robust security operations center and want that deep expertise in hunting to expose advanced threats. Microsoft Defender Experts MDR provides end-to-end security operations capabilities to monitor, investigate, and respond to security alerts. This service is meant for customers with constrained security operations centers (SOCs) that are overburdened with alert volume, in need of skilled experts, or both. Defender Experts MDR also includes the proactive threat hunting offered by Defender Experts Hunting|
+| **Does Defender Experts MDR require Microsoft Sentinel?** | No. Defender Experts can use Microsoft Defender data in customers' original locations for each Microsoft Defender product deployed.
A Sentinel instance is only required if you want to enrich Defender Experts MDR with third-party network signals. [Learn more](defender-experts-mdr-third-party-enrichment.md)|
+| **What products does Defender Experts MDR operate on?** | Refer to [Before you begin using Defender Experts MDR](defender-experts-mdr-prerequisites.md) for details. |
+| **Does Defender Experts MDR replace my SOC team?** | Defender Experts MDR currently provide coverage for Microsoft Defender incidents. It's the ideal way to augment your SOC team, reduce their workload, and collaborate with them to protect your organization from activity groups. |
+| **What actions can your experts take during incident investigation?** | Our expert analysts can take actions based on the roles granted to them in your Microsoft Defender portal. If our analysts are granted a security reader role, they can investigate and provide managed response for your SOC team to act on. If our analysts are granted a security operator role, they can also take specific remediation actions agreed upon with your SOC team. |
+| **What types of incidents can your experts investigate?** | Defender Experts MDR covers incidents categorized as High or Medium severity in Windows, Linux, and macOS devices. Incidents categorized as Compliance, Data Loss Prevention (DLP), or Custom Detections and those affecting internet of things (IoT), iOS, or Android devices are outside the service's scope. |
+| **Can your experts help me improve my security posture?** | Yes, our experts provide necessary guidance regularly to improve your security posture.
+| **Can Defender Experts MDR help with an active compromise or vulnerability?** | No, Defender Experts currently don't provide incident response services. Contact your Microsoft representative or fill out the [Experiencing a Cybersecurity Incident?](https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbRypQlJUvhTFIvfpiAfrpFQdUOTdRRFpDUFQ1TzNLVFZXV0VUOVlVN0szUiQlQCN0PWcu) form to engage Microsoft Defender Experts Cybersecurity Incident Response for incident response assistance. |
+| **How can my organization participate in the Defender Experts MDR and Microsoft Defender Experts for Servers services?** | Contact your Microsoft representative to express interest in Defender Experts MDR and Defender Experts for Servers services.|
+|**How is AI used in the Defender Experts service?**| AI is used to support the Defender Experts service by enhancing the speed, scale, and consistency of security operations. We use a combination of generative, agentic, and foundational AI to power workflows such as incident triage, investigation, and summarization by analyzing signals like telemetry and historical analyst actions. Defender Experts analysts review and validate these AI-generated insights to ensure quality and accuracy. AI helps scale expert capabilities, and human analysts remain central to the service, ensuring customers receive trusted outcomes.|
+
+
+### See also
+
+[How Microsoft Defender Experts MDR permissions work](defender-experts-mdr-permissions.md)
+
+[!INCLUDE [Microsoft Defender XDR rebranding](../../includes/defender-m3d-techcommunity.md)]
diff --git a/defender-xdr/get-started-xdr.md b/defender-xdr/defender-experts/defender-experts-mdr-get-started.md
similarity index 81%
rename from defender-xdr/get-started-xdr.md
rename to defender-xdr/defender-experts/defender-experts-mdr-get-started.md
index 0d9fb28fe3c..65cd34c6820 100644
--- a/defender-xdr/get-started-xdr.md
+++ b/defender-xdr/defender-experts/defender-experts-mdr-get-started.md
@@ -1,7 +1,7 @@
---
-title: Get started with Microsoft Defender Experts for XDR
+title: Get started with Microsoft Defender Experts MDR
ms.reviewer:
-description: Defender Experts for XDR let you determine the individuals or groups within your organization that need to be notified if there's a critical incident
+description: Defender Experts MDR let you determine the individuals or groups within your organization that need to be notified if there's a critical incident
ms.service: defender-experts-for-xdr
ms.author: pauloliveria
author: poliveria
@@ -18,11 +18,11 @@ ms.custom:
ms.date: 02/27/2026
---
-# Get started with Microsoft Defender Experts for XDR
+# Get started with Microsoft Defender Experts MDR
**Applies to:**
-- [Microsoft Defender Experts for XDR](dex-xdr-overview.md)
+- [Microsoft Defender Experts MDR](defender-experts-mdr-overview.md)
For onboarding instructions, watch this short video:
@@ -36,19 +36,19 @@ Select the link in the welcome email to directly launch the Defender Experts set
## Grant permissions to our experts
-By default, Defender Experts for XDR requires **Service provider access** that lets our experts sign into your tenant and deliver services based on assigned security roles. [Learn more about cross-tenant access](/azure/active-directory/external-identities/cross-tenant-access-overview)
+By default, Defender Experts MDR requires **Service provider access** that lets our experts sign into your tenant and deliver services based on assigned security roles. [Learn more about cross-tenant access](/azure/active-directory/external-identities/cross-tenant-access-overview)
You also need to grant our experts one or both of the following permissions:
- **Investigate incidents and guide my responses** (default) – This option lets our experts proactively monitor and investigate incidents and guide you through any necessary response actions. (Access level: Security Reader)
- **Respond directly to active threats** (recommended) – This option lets our experts contain and remediate active threats immediately while investigating, thus reducing the threat's impact, and improving your overall response efficiency. (Access level: Security Operator)
-:::image type="content" source="media/get-started-xdr/managed-exclusions.png" alt-text="Screenshot of manage exclusions option while setting up Defender Experts for XDR." lightbox="media/get-started-xdr/managed-exclusions.png":::
+:::image type="content" source="media/get-started-xdr/managed-exclusions.png" alt-text="Screenshot of manage exclusions option while setting up Defender Experts MDR." lightbox="media/get-started-xdr/managed-exclusions.png":::
> [!IMPORTANT]
> If you skip providing additional permissions, our experts won't be able to take certain response actions to secure your organization.
>
-> Even though our experts are granted these relatively powerful permissions, they'll only have individual access to specific areas for a limited period. [Learn more about how Defender Experts for XDR permissions work](dex-xdr-permissions.md)
+> Even though our experts are granted these relatively powerful permissions, they'll only have individual access to specific areas for a limited period. [Learn more about how Defender Experts MDR permissions work](defender-experts-mdr-permissions.md).
**To grant our experts permissions:**
@@ -62,7 +62,7 @@ To edit or update permissions after the initial setup, go to **Settings** > **De
## Exclude devices and users from remediation
-Defender Experts for XDR lets you exclude devices and users from remediation actions taken by our experts and instead get remediation guidance for those entities. These exclusions are based on identified [device groups](/defender-endpoint/machine-groups) in Microsoft Defender for Endpoint and identified [user groups](/entra/fundamentals/concept-learn-about-groups) in Microsoft Entra ID.
+Defender Experts MDR lets you exclude devices and users from remediation actions taken by our experts and instead get remediation guidance for those entities. These exclusions are based on identified [device groups](/defender-endpoint/machine-groups) in Microsoft Defender for Endpoint and identified [user groups](/entra/fundamentals/concept-learn-about-groups) in Microsoft Entra ID.
**To exclude device groups:**
@@ -92,7 +92,7 @@ Defender Experts for XDR lets you exclude devices and users from remediation act
1. Back on the **User groups** tab, review the list of excluded user groups. If you want to remove a user group from the exclusion list, choose it then select **Remove user group**.
1. Select **Next** to confirm your exclusion list and proceed to [adding contact persons or groups](#tell-us-who-to-contact-for-important-matters). Otherwise, select **Skip**, and all your added exclusions are discarded.
-:::image type="content" source="media/get-started-xdr/exclude-user-groups.png" alt-text="Screenshot to exclude user groups in Defender Experts for XDR." lightbox="media/get-started-xdr/exclude-user-groups.png":::
+:::image type="content" source="media/get-started-xdr/exclude-user-groups.png" alt-text="Screenshot to exclude user groups in Defender Experts MDR." lightbox="media/get-started-xdr/exclude-user-groups.png":::
> [!NOTE]
> You can only exclude users by adding them to a Microsoft Entra ID security group. On-premises Microsoft Entra ID users can't be excluded at this time.
@@ -102,7 +102,7 @@ To edit or update exclusions after the initial setup, go to **Settings** > **Def
diff --git a/sentinel/monitor-your-data.md b/sentinel/monitor-your-data.md
index e414062eb75..25aeb90d88e 100644
--- a/sentinel/monitor-your-data.md
+++ b/sentinel/monitor-your-data.md
@@ -1,14 +1,16 @@
---
-title: Visualize your data using workbooks in Microsoft Sentinel | Microsoft Docs
-description: Learn how to visualize your data using workbooks in Microsoft Sentinel.
+title: Visualize your data using workbooks in Microsoft Sentinel
+description: Create and customize Microsoft Sentinel workbooks to visualize and monitor security data using built-in templates or custom designs, with access managed through Azure RBAC.
author: EdB-MSFT
ms.topic: how-to
-ms.date: 08/20/2025
+ms.date: 06/15/2026
ms.author: edbaynash
appliesto:
- Microsoft Sentinel in the Microsoft Defender portal
- Microsoft Sentinel in the Azure portal
ms.collection: usx-security
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1014
#Customer intent: As a security analyst, I want to create and customize workbooks in Microsoft Sentinel so that I can visualize and monitor security data effectively.
@@ -25,6 +27,8 @@ Microsoft Sentinel allows you to create custom workbooks across your data or use
## Prerequisites
+Before you create or use workbooks, make sure you meet the following prerequisites:
+
- You must have at least **Workbook reader** or **Workbook contributor** permissions on the resource group of the Microsoft Sentinel workspace.
The workbooks that you see in Microsoft Sentinel are saved within the Microsoft Sentinel workspace's resource group and are tagged by the workspace in which they were created.
@@ -82,7 +86,8 @@ For more information, see:
- [Create interactive reports with Azure Monitor Workbooks](/azure/azure-monitor/visualize/workbooks-overview)
- [Tutorial: Visual data in Log Analytics](/azure/azure-monitor/visualize/tutorial-logs-dashboards)
-## Create new workbook
+
+## Create a new workbook
Create a workbook from scratch in Microsoft Sentinel.
@@ -100,7 +105,7 @@ Create a workbook from scratch in Microsoft Sentinel.
1. When you're done with your edits, select **Done editing** and then **Save**. In the side pane, enter a meaningful name for your workbook, and select the subscription and resource group for your workspace.
-1. When working in the Azure portal, switch between workbooks in your workspace by selecting **Open**  in the toolbar of any workbook. The screen switches to a list of other workbooks you can switch to.
+1. When working in the Azure portal, switch between workbooks in your workspace by selecting **Open**  in the toolbar of any workbook. The screen switches to a list of other workbooks you can switch to.
Select the workbook you want to open:
@@ -144,11 +149,14 @@ To print a workbook, or save it as a PDF, use the options menu to the right of t
You can delete both saved templates and customized workbooks from the **My workbooks** tab. Templates themselves can't be deleted.
-To delete a workbook, select the workbook in the **My workbooks** tab, and then select **Delete**. This action removes the workbook resource and any changes you made to the template. The original template remains available.
+> [!WARNING]
+> Deleting a workbook permanently removes the workbook resource and any customizations you made to the template. This action can't be undone. The original template remains available.
+
+To delete a workbook, select the workbook in the **My workbooks** tab, and then select **Delete**.
## Workbook recommendations
-This section reviews basic recommendations we have for using workbooks with Microsoft Sentinel.
+The following recommendations help you use Microsoft Sentinel workbooks effectively.
### Add Microsoft Entra ID workbooks
@@ -177,6 +185,8 @@ Use the following query to create a visualization that compares traffic trends a
The following sample query uses the **SecurityEvent** table from Windows. You might want to switch it to run on the **AzureActivity** or **CommonSecurityLog** table, on any other firewall.
+The query compares daily security event counts between the current week and the previous week, so you can quickly spot unusual changes in event volume.
+
```kusto
// week over week query
SecurityEvent
@@ -187,7 +197,9 @@ SecurityEvent
### Sample query with data from multiple sources
-You might want to create a query that incorporates data from multiples sources. For example, create a query that looks at Microsoft Entra audit logs for new users that were created, and then checks your Azure logs to see if the user started making role assignment changes within 24 hours of creation. That suspicious activity would show up in a visualization with the following query:
+You might want to create a query that incorporates data from multiples sources. For example, create a query that looks at Microsoft Entra audit logs for new users that were created, and then checks your Azure activity logs to see if the user started making Azure RBAC role assignment changes within 24 hours of creation. That suspicious activity would show up in a visualization with the following query.
+
+The following query finds newly created users in Microsoft Entra audit logs and joins them with Azure activity logs to detect role assignment changes made within 24 hours of user creation.
```kusto
AuditLogs
diff --git a/sentinel/move-to-defender.md b/sentinel/move-to-defender.md
index 51f5c632961..ad9b4c0ca00 100644
--- a/sentinel/move-to-defender.md
+++ b/sentinel/move-to-defender.md
@@ -5,8 +5,10 @@ ms.author: guywild
author: guywi-ms
ms.reviewer: soulisabag
ms.topic: how-to #Required; leave this attribute/value as-is
-ms.date: 03/17/2026
+ms.date: 06/22/2026
ms.collection: usx-security
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1014
#Customer intent: As a security operations team member, I want to understand the process involved in moving our Microsoft Sentinel experience from the Azure portal to the Defender portal so that I can benefit from unified security operations across my entire environment.
---
@@ -15,7 +17,7 @@ ms.collection: usx-security
Microsoft Sentinel is available in the Microsoft Defender portal with [Microsoft Defender XDR](/microsoft-365/security/defender) or on its own. It delivers a unified experience across SIEM and XDR for faster, more accurate threat detection and response, simpler workflows, and better operational efficiency.
-This article explains how to transition your Microsoft Sentinel experience from the Azure portal to the Defender portal. If you use Microsoft Sentinel in the Azure portal, transition to Microsoft Defender for unified security operations and the latest features. For more information, see [Microsoft Sentinel in the Microsoft Defender portal](microsoft-sentinel-defender-portal.md) or watch our [YouTube playlist](https://www.youtube.com/playlist?list=PL3ZTgFEc7Lyska6WLWBzc8sob-kYA2jPj).
+This article explains how to transition your Microsoft Sentinel experience from the Azure portal to the Defender portal. If you use Microsoft Sentinel in the Azure portal, transition to Microsoft Defender for unified security operations and the latest features. Before you begin, review the [Prerequisites](#prerequisites) section for required access and preparatory steps. For more information, see [Microsoft Sentinel in the Microsoft Defender portal](microsoft-sentinel-defender-portal.md) or watch our [YouTube playlist](https://www.youtube.com/playlist?list=PL3ZTgFEc7Lyska6WLWBzc8sob-kYA2jPj).
> [!NOTE]
> Transitioning to the Defender portal, even for non-E5 customers, has no extra cost for the customer. The customer continues to be billed as usual for their consumption on Sentinel only.
@@ -26,7 +28,7 @@ Before you start, note:
- This article is for customers with an existing workspace enabled for Microsoft Sentinel who want to transition their Microsoft Sentinel experience to the Defender portal. If you're a new customer who onboarded with permissions of a subscription [Owner](/azure/role-based-access-control/built-in-roles#owner) or a [User access administrator](/azure/role-based-access-control/built-in-roles#user-access-administrator), your workspaces are [automatically onboarded to the Defender portal](quickstart-onboard.md).
-- Some Microsoft Sentinel features have new locations in the Defender portal. For more information, see [Quick reference](microsoft-sentinel-defender-portal.md#quick-reference).
+- Some Microsoft Sentinel features have new locations in the Defender portal. For more information, see [Quick reference for Microsoft Sentinel feature locations in the Defender portal](microsoft-sentinel-defender-portal.md#quick-reference).
- When relevant, detailed prerequisites are in the linked articles for each step.
@@ -46,11 +48,11 @@ Review all planning guidance and finish all prerequisites before you onboard you
- [**Plan for unified security operations in the Defender portal**](/unified-secops-platform/overview-plan). After onboarding to the Defender portal, the **[Microsoft Sentinel Contributor](/azure/role-based-access-control/built-in-roles/security#microsoft-sentinel-contributor)** role is assigned to the **Microsoft Threat Protection** and **WindowsDefenderATP** apps in your subscription.
-- [**Manage Microsoft Sentinel and Defender XDR permissions in the Defender portal**](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/managing-microsoft-sentinel-and-microsoft-defender-xdr-permissions-in-microsoft-/4480583). This blog post explains how Microsoft Sentinel and Defender XDR permissions work in the unified Defender portal, what to expect as you transition, as well as an introduction to the new unified role-based access control (URBAC). To read more about URBAC, see [Map Microsoft Defender XDR unified RBAC permissions to existing RBAC permissions](/defender-xdr/compare-rbac-roles#map-microsoft-defender-xdr-unified-rbac-permissions-to-existing-rbac-permissions).
+- [**Manage Microsoft Sentinel and Defender XDR permissions in the Defender portal**](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/managing-microsoft-sentinel-and-microsoft-defender-xdr-permissions-in-microsoft-/4480583). The "Manage Microsoft Sentinel and Defender XDR permissions in the Defender portal" blog post explains how Microsoft Sentinel and Defender XDR permissions work in the unified Defender portal, what to expect as you transition, as well as an introduction to the new unified role-based access control (URBAC). To read more about URBAC, see [Map Microsoft Defender XDR unified RBAC permissions to existing RBAC permissions](/defender-xdr/compare-rbac-roles#map-microsoft-defender-xdr-unified-rbac-permissions-to-existing-rbac-permissions).
- [**Deploy for unified security operations in the Defender portal**](/unified-secops-platform/overview-deploy). While this article is for new customers who don't yet have a workspace for Microsoft Sentinel or other services onboarded to the Defender portal, use it as a reference if you're moving to the Defender portal.
-- [**Connect Microsoft Sentinel to the Defender portal**](/unified-secops-platform/microsoft-sentinel-onboard). This article lists the prerequisites for onboarding your workspace to the Defender portal. If you plan to use Microsoft Sentinel without Defender XDR, you need to take an extra step to trigger the connection between Microsoft Sentinel and the Defender portal.
+- [**Connect Microsoft Sentinel to the Defender portal**](/unified-secops-platform/microsoft-sentinel-onboard). The "Connect Microsoft Sentinel to the Defender portal" article lists the prerequisites for onboarding your workspace to the Defender portal. If you plan to use Microsoft Sentinel without Defender XDR, you need to take an extra step to trigger the connection between Microsoft Sentinel and the Defender portal.
### Review differences for data storage and privacy
@@ -60,27 +62,24 @@ The following table provides additional details and links so that you can compar
|Area of support |Azure portal |Defender portal |
|---------|---------|---------|
-|**BCDR** | Customers are responsible for replicating their data | Microsoft Defender uses automation for BCDR on control panes. |
+|**Business continuity and disaster recovery (BCDR)** | Customers are responsible for replicating their data | Microsoft Defender uses automation for BCDR on control planes. |
|**Data storage and processing** | - [Data storage location](geographical-availability-data-residency.md#data-storage-location)
- [Supported regions](geographical-availability-data-residency.md#supported-regions) | [Data storage location](/defender-xdr/data-privacy#data-storage-location) |
|**Data retention** | [Data retention](geographical-availability-data-residency.md#data-retention) | [Data retention](/defender-xdr/data-privacy#data-retention) |
|**Data sharing** | [Data sharing](geographical-availability-data-residency.md#data-sharing-for-microsoft-sentinel) | [Data sharing](/defender-xdr/data-privacy#data-sharing) |
-For more information, see:
-
-- [Geographical availability and data residency in Microsoft Sentinel](geographical-availability-data-residency.md)
-- [Data security and retention in Microsoft Defender XDR](/defender-xdr/data-privacy)
+For more information about data storage and privacy policies, see [Geographical availability and data residency in Microsoft Sentinel](geographical-availability-data-residency.md) and [Data security and retention in Microsoft Defender XDR](/defender-xdr/data-privacy).
### Onboarding to the Defender portal with customer-managed keys (CMK)
+> [!IMPORTANT]
+> CMK encryption is not fully supported for data stored in the Microsoft Sentinel data lake. All data ingested into the data lake - such as custom tables or transformed data - is encrypted using Microsoft-managed keys.
+
If you enabled CMK before onboarding, when you onboard your Microsoft Sentinel-enabled workspace to the Defender portal, all log data in your workspace continues to be encrypted with CMK - including both previously and newly ingested data.
Analytic rules and other Sentinel content, such as automation rules, also continue to be CMK-encrypted. However, alerts and incidents will no longer be CMK-encrypted after onboarding.
For more information about CMK, see [Set up Microsoft Sentinel customer-managed key](customer-managed-keys.md).
-> [!IMPORTANT]
-> CMK encryption is not fully supported for data stored in the Microsoft Sentinel data lake. All data ingested into the data lake - such as custom tables or transformed data - is encrypted using Microsoft-managed keys.
-
### Configure multi-workspace and multitenant management
@@ -88,13 +87,13 @@ Defender supports one or more workspaces across multiple tenants through the [mu
In multi-workspace scenarios, the multitenant portal lets you connect one primary workspace and multiple secondary workspaces per tenant. Onboard each workspace to the Defender portal separately for each tenant, just like onboarding for a single tenant.
-For more information, see:
+For more information about multitenant and multi-workspace configuration, see:
- [**Set up Microsoft Defender multitenant management**](/unified-secops-platform/mto-requirements)
- [**Azure Lighthouse documentation**](/azure/lighthouse/how-to/manage-sentinel-workspaces). Azure Lighthouse lets you use Microsoft Sentinel data from other tenants across onboarded workspaces. For example, you can run cross-workspace queries with the `workspace()` operator in Advanced hunting and analytics rules.
-- [**Microsoft Entra B2B**](/entra/identity/multi-tenant-organizations/overview#b2b-direct-connect). Microsoft Entra B2B lets you access data across tenants. GDAP for Microsoft Sentinel is in preview.
+- [**Microsoft Entra B2B**](/entra/identity/multi-tenant-organizations/overview#b2b-direct-connect). Microsoft Entra B2B lets you access data across tenants. Granular Delegated Admin Privileges (GDAP) for Microsoft Sentinel is in preview.
## Configure and review your settings and content
@@ -110,15 +109,19 @@ In multi-workspace environments, the Microsoft Defender XDR connector is connect
From a Log Analytics perspective, Microsoft Sentinel’s integration into Microsoft Defender doesn't change how Microsoft Sentinel stores log data in Log Analytics. Despite the front-end unification, the Microsoft Sentinel backend remains fully integrated with Log Analytics for data storage, search, and correlation.
-Alerts related to Defender products are streamed directly from the [Microsoft Defender XDR connector](/azure/sentinel/connect-microsoft-365-defender) to ensure consistency. Make sure that you have incidents and alerts from this connector turned on in your workspace. Once you have this data connector configured in your workspace, [offboarding the workspace from Microsoft Defender](/unified-secops/microsoft-sentinel-onboard#offboard-microsoft-sentinel) also disconnects the Microsoft Defender XDR connector.
+Alerts related to Defender products are streamed directly from the [Microsoft Defender connector](/azure/sentinel/connect-microsoft-365-defender) to ensure consistency. Make sure that you have incidents and alerts from this connector turned on in your workspace. Once you have this data connector configured in your workspace, [offboarding the workspace from Microsoft Defender](/unified-secops/microsoft-sentinel-onboard#offboard-microsoft-sentinel) also disconnects the Microsoft Defender connector.
> [!NOTE]
> This change in connectors results in schema differences for some alerts. For a detailed comparison, see [Alert schema differences: Standalone vs. Microsoft Defender XDR connector](security-alert-schema-differences.md).
-For more information, see [Connect data from Microsoft Defender XDR to Microsoft Sentinel](connect-microsoft-365-defender.md).
+To migrate analytics rule incident creation and alert grouping settings, see [Migrate Microsoft Sentinel incident creation rules and alert grouping settings to Defender XDR](/unified-secops-platform/migrate-sentinel-incident-creation-rules-alert-grouping).
+
+For more information, see [Connect data from Microsoft Defender to Microsoft Sentinel](connect-microsoft-365-defender.md).
#### Integrate with Microsoft Defender for Cloud
+Review the following connector-specific actions to avoid duplicate events when integrating Microsoft Defender for Cloud with the Defender portal:
+
- If you're using the tenant-based data connector for Defender for Cloud, make sure to take action to prevent duplicate events and alerts.
- If you're using the legacy, subscription-based connector instead, make sure to opt out of syncing incidents and alerts to Microsoft Defender.
@@ -156,10 +159,10 @@ When moving to the Defender portal, the following changes are important to note:
| Feature | Description |
|--------------|-----|
-| **Custom detection rules** | If you have detection use cases that involve both Defender XDR and Microsoft Sentinel data, where you don't need to retain Defender XDR data for more than 30 days, we recommend creating [custom detection rules](/defender-xdr/custom-detections-overview) that query data from both Microsoft Sentinel and Defender XDR tables.
This is supported without needing to ingest Defender XDR data into Microsoft Sentinel. For more information, see [Use Microsoft Sentinel custom functions in advanced hunting in Microsoft Defender](/defender-xdr/advanced-hunting-defender-use-custom-rules#custom-detection-rules). |
+| **Custom detection rules** | If you have detection use cases that involve both Defender XDR and Microsoft Sentinel data, where you don't need to retain Defender XDR data for more than 30 days, we recommend creating [custom detection rules](/defender-xdr/custom-detections-overview) that query data from both Microsoft Sentinel and Defender XDR tables.
This is supported without needing to ingest Defender XDR data into Microsoft Sentinel. For more information, see [Use Microsoft Sentinel custom functions in advanced hunting in Microsoft Defender](/defender-xdr/advanced-hunting-defender-use-custom-rules#custom-detection-rules). |
| **Alert correlation** | In the Defender portal, correlations are automatically applied to alerts against both Microsoft Defender data and third-party data ingested from Microsoft Sentinel, regardless of alert scenarios.
The criteria used to correlate alerts together in a single incident are part of the Defender portal's proprietary, internal correlation logic. For more information, see [Alert correlation and incident merging in the Defender portal](/defender-xdr/alerts-incidents-correlation). |
| **Alert grouping and incident merging** | While you will still see the alert grouping configuration in Analytics rules, the [Defender XDR correlation engine](/defender-xdr/alerts-incidents-correlation) fully controls alert grouping and incident merging when necessary in the Defender portal. This ensures a comprehensive view of the full attack story by stitching together relevant alerts for multi-stage attacks.
For example, multiple individual analytics rules configured to generate an incident for each alert may result in merged incidents if they match Defender XDR correlation logic. |
-| **Alert visibility** | If you have Microsoft Sentinel analytics rules [configured to trigger alerts only](create-analytics-rules.md#configure-the-incident-creation-settings), with incident creation turned off, these alerts aren't visible in the Defender portal. |
+| **Alert visibility** | If you have Microsoft Sentinel analytics rules configured to trigger alerts only (see [Configure incident creation settings](create-analytics-rules.md#configure-the-incident-creation-settings)), with incident creation turned off, these alerts aren't visible in the Defender portal. |
| **Alert tuning** | Once your Microsoft Sentinel workspace is onboarded to Defender, all incidents, including those from your Microsoft Sentinel analytics rules, are generated by the Defender XDR engine. As a result, the [alert tuning capabilities](/defender-xdr/investigate-alerts#tune-an-alert) in the Defender portal, previously available only for Defender XDR alerts, can now be applied to alerts from Microsoft Sentinel.
This feature allows you to streamline incident response by automating the resolution of common alerts, reducing false positives, and minimizing noise, so analysts can prioritize significant security incidents. |
| **Fusion: Advanced multistate attack detection** | The Fusion analytics rule, which in the Azure portal, creates incidents based on alert correlations made by the Fusion correlation engine, is disabled when you onboard Microsoft Sentinel to the Defender portal.
You don't lose alert correlation functionality because the Defender portal uses Microsoft Defender XDR's incident-creation and correlation functionalities to replace those of the Fusion engine.
For more information, see [Advanced multistage attack detection in Microsoft Sentinel](fusion.md) |
@@ -176,7 +179,7 @@ The following limitations apply to Microsoft Sentinel automation rules and playb
The unified experience in the Defender portal introduces notable changes to incidents and alerts from APIs. It supports API calls based on the [Microsoft Graph REST API v1.0](/graph/api/resources/security-api-overview?view=graph-rest-1.0&preserve-view=true), which can be used for automation related to alerts, incidents, advanced hunting, and more.
The [Microsoft Sentinel API](/rest/api/securityinsights/api-versions) continues to support actions against Microsoft Sentinel resources, like analytics rules, automation rules and more. For interacting with unified incidents and alerts, we recommend that you use the Microsoft Graph REST API.
-If you're using the Microsoft Sentinel `SecurityInsights` API to interact with Microsoft Sentinel incidents, you may need to update your automation conditions and trigger criteria due to changes in the response body.
+If you're using the Microsoft Sentinel `SecurityInsights` API to interact with Microsoft Sentinel incidents, you might need to update your automation conditions and trigger criteria due to changes in the response body.
The following table lists fields that are important in the response snippets, and compares them across the Azure and Defender portals:
@@ -205,7 +208,7 @@ The following table lists fields that are important in the response snippets, an
### Update incident triage processes for the Defender portal
-If you've used Microsoft Sentinel in the Azure portal, you'll notice significant user experience enhancements in the Defender portal. While you may need to update SOC processes and retrain your analysts, the design consolidates all relevant information in a single place to provide more streamlined and efficient workflows.
+If you've used Microsoft Sentinel in the Azure portal, you'll notice significant user experience enhancements in the Defender portal. While you might need to update SOC processes and retrain your analysts, the design consolidates all relevant information in a single place to provide more streamlined and efficient workflows.
The unified incident queue in the Defender portal consolidates all incidents across products into a single view, impacting how analysts triage incidents that now contain multiple, cross-security domain alerts. For example:
@@ -216,6 +219,8 @@ Analysts can also view detection sources and product names in the Defender porta
The unified triage process can help reduce analyst workloads and even potentially combine the roles of tier 1 and tier 2 analysts. However, the unified triage process can also require broader and deeper analyst knowledge. We recommend training on the new portal interface to ensure a smooth transition.
+The Defender portal also provides investigation capabilities that aren't available in the Azure portal, including the [attack story and incident graph](/defender-xdr/investigate-incidents#attack-story) for visualizing the full scope of an attack, and [blast radius analysis](/defender-xdr/investigate-incidents#blast-radius-analysis) to help analysts visualize possible propagation paths, assess business impact, and prioritize containment actions.
+
For more information, see [Incidents and alerts in the Microsoft Defender portal](/defender-xdr/incidents-overview?toc=%2Fazure%2Fsentinel%2FTOC.json&bc=%2Fazure%2Fsentinel%2Fbreadcrumb%2Ftoc.json).
### Understand how alerts are correlated and incidents are merged in the Defender portal
@@ -242,15 +247,15 @@ For more information, see [Incidents and alerts in the Microsoft Defender portal
After onboarding Microsoft Sentinel to the Defender portal, access and use all your existing log tables, Kusto Query Language (KQL) queries, and functions in the **Advanced hunting** page. All Microsoft Sentinel alerts that are tied to incidents are ingested into the `AlertInfo` table, accessible from the **Advanced hunting** page.
-Some differences exist, such as bookmarks aren't supported in **Advanced hunting**. Instead, bookmarks are supported in the Defender portal under **Microsoft Sentinel > Threat management > Hunting**.
+Bookmarks aren't available in Advanced hunting, which provides a unified query experience across Microsoft Defender and Microsoft Sentinel data. However, bookmarks are still available in **Microsoft Sentinel** > **Threat management** > **Hunting**, which provides the Microsoft Sentinel-specific hunting experience. You can also use alternatives such as incident tags, saved queries, or custom hunting tables to preserve and track investigation context.
-For more information, see [Advanced hunting with Microsoft Sentinel data in Microsoft Defender](/defender-xdr/advanced-hunting-microsoft-defender), especially the list of [known issues](/defender-xdr/advanced-hunting-microsoft-defender), and [Keep track of data during hunting with Microsoft Sentinel](/azure/sentinel/bookmarks).
+For more information, see [Advanced hunting with Microsoft Sentinel data in Microsoft Defender](/defender-xdr/advanced-hunting-microsoft-defender), especially the list of [known issues for advanced hunting with Microsoft Sentinel data](/defender-xdr/advanced-hunting-microsoft-defender), and [Keep track of data during hunting with Microsoft Sentinel](/azure/sentinel/bookmarks).
### Investigate with entities in the Defender portal
In the Microsoft Defender portal, entities are generally either *assets*, such as accounts, hosts, or mailboxes, or *evidence*, such as IP addresses, files, or URLs.
-After onboarding Microsoft Sentinel to the Defender portal, entity pages for [users](/defender-xdr/investigate-users), [devices](/defender-xdr/entity-page-device), and IP addresses are consolidated into a single view with a comprehensive view of the entity's activity and context and data from both Microsoft Sentinel and Microsoft Defender XDR.
+After onboarding Microsoft Sentinel to the Defender portal, entity pages for [user entities](/defender-xdr/investigate-users), [device entities](/defender-xdr/entity-page-device), and IP addresses are consolidated into a single view with a comprehensive view of the entity's activity and context and data from both Microsoft Sentinel and Microsoft Defender XDR.
The Defender portal also provides a global search bar that centralizes results from all entities so that you can search across SIEM and XDR.
@@ -258,7 +263,7 @@ For more information, see [Entity pages in Microsoft Sentinel](/azure/sentinel/e
### Investigate with UEBA in the Defender portal
-Most functionalities of User and Entity Behavior Analytics (UEBA) remain the same in the Defender portal as they were in the Azure portal, with the following exceptions:
+Most functionalities of User and Entity Behavior Analytics (UEBA) remain the same in the Defender portal as they were in the Azure portal, with exceptions for adding entities to threat intelligence and for `IdentityInfo` table schema differences:
- Adding entities to threat intelligence from incidents is supported only in the Azure portal. For more information, see [Add entity to threat indicators](add-entity-to-threat-intelligence.md).
@@ -282,7 +287,7 @@ In the Defender portal, use the `ThreatIntelOjbects` and `ThreatIntelIndicators`
For customers using the Microsoft Defender Threat Intelligence (MDTI) feed, a free version is available via Microsoft Sentinel's data connector for MDTI. Users with MDTI licenses can also ingest MDTI data and use Security Copilot for threat analysis, active threat review, and threat actor research.
-For more information, see:
+For more information about threat management, threat analytics, intelligence projects, and threat intelligence in Microsoft Sentinel, see:
- [Threat management](microsoft-sentinel-defender-portal.md#threat-management)
- [Threat analytics in Microsoft Defender XDR](/defender-xdr/threat-analytics)
@@ -299,11 +304,13 @@ For more information, see [Visualize and monitor your data by using workbooks in
### Similar incidents (Preview) aren't supported in the Defender portal
-The Microsoft Sentinel [similar incidents](investigate-cases.md#similar-incidents-preview) feature is in Preview, isn't supported in the Defender portal. This means that when viewing an incident details page in the Defender portal, the **Similar incidents** tab isn't available.
+The Microsoft Sentinel [similar incidents in case investigations](investigate-cases.md#similar-incidents-preview) feature is in Preview and isn't supported in the Defender portal. This means that when viewing an incident details page in the Defender portal, the **Similar incidents** tab isn't available.
## Related content
+Use the following resources to learn more about transitioning Microsoft Sentinel to the Defender portal:
+
- [The Best of Microsoft Sentinel - now in Microsoft Defender](https://techcommunity.microsoft.com/blog/MicrosoftThreatProtectionBlog/the-best-of-microsoft-sentinel-%E2%80%94-now-in-microsoft-defender/4415822) (blog)
- Watch the webinar: [Transition to the Unified SOC Platform: Deep Dive and Interactive Q&A for SOC Professionals](https://www.youtube.com/watch?v=WIM6fbJDkK4).
- See frequently asked questions in the [TechCommunity blog](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/unified-security-operations-platform---technical-faq/4189136) or the [Microsoft Community Hub](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/frequently-asked-questions-about-the-unified-security-operations-platform/4212048).
-- Review [alert schema differences between standalone and Microsoft Defender XDR connectors](security-alert-schema-differences.md)
\ No newline at end of file
+- Review [alert schema differences between standalone and Microsoft Defender XDR connectors](security-alert-schema-differences.md)
diff --git a/sentinel/mssp-protect-intellectual-property.md b/sentinel/mssp-protect-intellectual-property.md
index e8fad6a4955..64262e834e5 100644
--- a/sentinel/mssp-protect-intellectual-property.md
+++ b/sentinel/mssp-protect-intellectual-property.md
@@ -1,10 +1,12 @@
---
title: Protecting managed security service provider (MSSPs) intellectual property in Microsoft Sentinel
-description: Learn about how managed security service providers (MSSPs) can protect the intellectual property they've created in Microsoft Sentinel.
+description: Protect Microsoft Sentinel intellectual property such as analytics rules, hunting queries, playbooks, and workbooks. Compare protection approaches for CSP and EA/PAYG customer purchasing models.
author: EdB-MSFT
ms.topic: how-to
-ms.date: 01/09/2023
+ms.date: 06/15/2026
ms.author: edbaynash
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1014
#Customer intent: As an MSSP, I want to understand how to protect my intellectual property in Microsoft Sentinel so that I can maintain control over my proprietary analytics rules, hunting queries, playbooks, and workbooks while providing managed security services to my customers.
@@ -15,11 +17,12 @@ ms.author: edbaynash
This article describes the methods that managed security service providers (MSSPs) can use to protect intellectual property they've developed in Microsoft Sentinel, such as Microsoft Sentinel analytics rules, hunting queries, playbooks, and workbooks.
-The method you choose depends on how each of your customers buys Azure; whether you act as a [Cloud Solutions Provider (CSP)](#cloud-solutions-providers-csp), or the customer has an [Enterprise Agreement (EA)/Pay-as-you-go (PAYG)](#enterprise-agreements-ea--pay-as-you-go-payg) account. The following sections describe each of these methods separately.
+The method you choose depends on how each of your customers buys Azure; whether you act as a [Cloud Solutions Provider (CSP)](#cloud-solutions-providers-csp), or the customer has an [Enterprise Agreement (EA)/Pay-as-you-go (PAYG)](#enterprise-agreements-ea--pay-as-you-go-payg) account. The [Cloud Solutions Providers (CSP)](#cloud-solutions-providers-csp) and [Enterprise Agreements (EA) / Pay-as-you-go (PAYG)](#enterprise-agreements-ea--pay-as-you-go-payg) sections describe each of these methods separately.
-## Cloud Solutions Providers (CSP)
+
+## Protect MSSP intellectual property in Cloud Solutions Provider (CSP) environments
-If you're reselling Azure as a Cloud Solutions Provider (CSP), you're managing the customer's Azure subscription. Thanks to [Admin-On-Behalf-Of (AOBO)](/partner-center/azure-plan-manage), users in the Admin Agents group from your MSSP tenant are granted with Owner access to the customer's Azure subscription, and the customer has no access by default.
+If you're reselling Azure as a Cloud Solutions Provider (CSP), you're managing the customer's Azure subscription. Thanks to [Admin-On-Behalf-Of (AOBO)](/partner-center/azure-plan-manage), which lets partner admin agents manage a customer's subscription, users in the Admin Agents group (the Partner Center role whose members administer customer subscriptions) from your MSSP tenant are granted Owner access to the customer's Azure subscription, and the customer has no access by default.
If other users from the MSSP tenant, outside of the Admin Agents group, need to access the customer environment, we recommend that you use [Azure Lighthouse](multiple-tenants-service-providers.md). Azure Lighthouse enables you to grant users or groups with access to a specific scope, such as a resource group or subscription, using one of the built-in roles.
@@ -39,7 +42,7 @@ Even with granting access at the resource group level, customers have access to
### Sample Microsoft Sentinel CSP architecture
-The following image describes how the permissions described in the [previous section](#cloud-solutions-providers-csp) might work when providing access to CSP customers:
+The following image describes how the CSP permissions described in the [Cloud Solutions Providers (CSP)](#cloud-solutions-providers-csp) section might work when providing access to CSP customers:
:::image type="content" source="media/mssp-protect-intellectual-property/csp-customers.png" alt-text="Protect your Microsoft Sentinel intellectual property with CSP customers.":::
@@ -49,11 +52,12 @@ In this image:
- Other groups from the MSSP get access to the customer environment via Azure Lighthouse.
- Customer access to Azure resources is managed by Azure RBAC at the resource group level.
- This allows MSSPs to hide Microsoft Sentinel components as needed, like Analytics Rules and Hunting Queries.
+ Managing customer access at the resource group level allows MSSPs to hide Microsoft Sentinel components as needed, such as analytics rules and hunting queries.
For more information, also see the [Azure Lighthouse documentation](/azure/lighthouse/concepts/cloud-solution-provider).
-## Enterprise Agreements (EA) / Pay-as-you-go (PAYG)
+
+## Protect MSSP intellectual property in Enterprise Agreement and Pay-as-you-go environments
If your customer is buying directly from Microsoft, the customer already has full access to the Azure environment, and you can't hide anything that's in the customer's Azure subscription.
@@ -63,7 +67,7 @@ Instead, protect your intellectual property that you've developed in Microsoft S
Analytics rules and hunting queries are both contained within Microsoft Sentinel, and therefore can't be separated from the Microsoft Sentinel workspace.
-Even if a user only has Microsoft Sentinel Reader permissions, they can view the query. In this case, we recommend hosting your Analytics rules and hunting queries in your own MSSP tenant, instead of the customer tenant.
+Even if a user only has Microsoft Sentinel Reader permissions, they can view the query. Because Reader permissions still expose queries, we recommend hosting your analytics rules and hunting queries in your own MSSP tenant, instead of the customer tenant.
To do this, you need a workspace in your own tenant with Microsoft Sentinel enabled, and you also need to see the customer workspace via [Azure Lighthouse](multiple-tenants-service-providers.md).
@@ -80,7 +84,7 @@ When adding a `workspace` statement to your analytics rules, consider the follow
- **No alerts in the customer workspace**. Rules created in this manner, don't create alerts or incidents in the customer workspace. Both alerts and incidents exist in your MSSP workspace only.
-- **Create separate alerts for each customer**. When you use this method, we also recommend that you use separate alert rules for each customer and detection, as the workspace statement is different in each case.
+- **Create separate alerts for each customer**. When you create cross-workspace analytics rules, we also recommend that you use separate alert rules for each customer and detection, because the workspace statement is different in each case.
You can add the customer name to the alert rule name to easily identify the customer where the alert is triggered. Separate alerts may result in a large number of rules, which you might want to manage using scripting, or [Microsoft Sentinel as Code](https://techcommunity.microsoft.com/t5/azure-sentinel/deploying-and-managing-azure-sentinel-as-code/ba-p/1131928).
@@ -95,14 +99,14 @@ When adding a `workspace` statement to your analytics rules, consider the follow
:::image type="content" source="media/mssp-protect-intellectual-property/mssp-rules-and-workspace-per-customer.png" alt-text="Create a workspace and rules in your MSSP tenant for each customer.":::
> [!IMPORTANT]
-> The key to using this method successfully is using automation to manage a large set of rules across your workspaces.
+> The key to using cross-workspace analytics rules successfully is using automation to manage a large set of rules across your workspaces.
>
> For more information, see [Cross-workspace analytics rules](https://techcommunity.microsoft.com/t5/azure-sentinel/what-s-new-cross-workspace-analytics-rules/ba-p/1664211)
>
### Workbooks
-If you have developed a Microsoft Sentinel workbook that you don't want your customer to copy, host the workbook in your MSSP tenant. Make sure that you have access to your customer workspaces via Azure Lighthouse, and then make sure to modify the workbook to use those customer workspaces.
+If you developed a Microsoft Sentinel workbook that you don't want your customer to copy, first make sure that you have access to your customer workspaces via Azure Lighthouse. Then host the workbook in your MSSP tenant and modify it to use those customer workspaces.
For example:
diff --git a/sentinel/multiple-tenants-service-providers.md b/sentinel/multiple-tenants-service-providers.md
index b4525e5d3c5..33aee3b251a 100644
--- a/sentinel/multiple-tenants-service-providers.md
+++ b/sentinel/multiple-tenants-service-providers.md
@@ -1,11 +1,13 @@
---
-title: Manage multiple tenants in Microsoft Sentinel as a Managed Security Service Provider | Microsoft Docs
+title: Manage multiple tenants in Microsoft Sentinel as a Managed Security Service Provider
description: How to onboard and manage multiple tenants in Microsoft Sentinel as a Managed Security Service Provider (MSSP) using Azure Lighthouse.
ms.author: guywild
author: guywi-ms
ms.reviewer: yobasha
ms.topic: how-to
-ms.date: 11/11/2024
+ms.date: 06/15/2026
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1014
#Customer intent: As an MSSP, I want to manage multiple Microsoft Sentinel tenants from my own Azure tenant so that I can efficiently provide SOC services to my customers.
@@ -16,7 +18,7 @@ ms.date: 11/11/2024
If you're a managed security service provider (MSSP) and you're using [Azure Lighthouse](/azure/lighthouse/overview) to offer security operations center (SOC) services to your customers, you can manage your customers' Microsoft Sentinel resources directly from your own Azure tenant, without having to connect to the customer's tenant.
> [!IMPORTANT]
-> After **March 31, 2027**, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. All customers using Microsoft Sentinel in the Azure portal will be [redirected to the Defender portal and will use Microsoft Sentinel in the Defender portal only](overview.md#microsoft-sentinel-in-the-azure-portal-retirement-timeline).
+> After **March 31, 2027**, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. All customers using Microsoft Sentinel in the Azure portal will be [redirected to the Defender portal](overview.md#microsoft-sentinel-in-the-azure-portal-retirement-timeline).
>
> If you're still using Microsoft Sentinel in the Azure portal, we recommend that you start planning your move to the Defender portal to ensure a smooth experience and to take full advantage of unified security operations and multitenant management capabilities offered by the Defender portal. For guidance and best practices, see the [Microsoft Defender portal implementation guide for MSSPs](/unified-secops/playbook-managed-security).
@@ -42,6 +44,8 @@ If you have registered Microsoft Sentinel in your tenant, and your customers in
## Access Microsoft Sentinel in managed tenants
+To access your customers' Microsoft Sentinel workspaces from your own tenant, perform the following steps:
+
1. Under **Directory + subscription**, select the delegated directories (directory = tenant), and the subscriptions where your customer's Microsoft Sentinel workspaces are located.
:::image type="content" source="media/multiple-tenants-service-providers/directory-subscription.png" alt-text="Choose tenants and subscriptions":::
@@ -53,7 +57,7 @@ If you have registered Microsoft Sentinel in your tenant, and your customers in
## Related content
-In this document, you learned how to manage multiple Microsoft Sentinel tenants seamlessly. To learn more about Microsoft Sentinel, see the following articles:
+For more information about Microsoft Sentinel, see the following articles:
- Learn how to [get visibility into your data, and potential threats](get-visibility.md).
- Get started [detecting threats with Microsoft Sentinel](detect-threats-built-in.md).
diff --git a/sentinel/multiple-workspace-view.md b/sentinel/multiple-workspace-view.md
index 0dcf2759761..d2b87a913cd 100644
--- a/sentinel/multiple-workspace-view.md
+++ b/sentinel/multiple-workspace-view.md
@@ -1,13 +1,15 @@
---
-title: Work with Microsoft Sentinel incidents in many workspaces at once | Microsoft Docs
+title: Work with Microsoft Sentinel incidents in many workspaces at once
description: How to view incidents in multiple workspaces concurrently in Microsoft Sentinel.
ms.author: guywild
author: guywi-ms
ms.reviewer: idpelleg
ms.topic: how-to
-ms.date: 10/17/2024
+ms.date: 06/15/2026
appliesto:
- Microsoft Sentinel in the Azure portal
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1014
#Customer intent: As a security analyst, I want to manage and investigate incidents across multiple workspaces and tenants so that I can maintain comprehensive visibility and control over my organization's security posture.
@@ -24,7 +26,8 @@ If you onboard Microsoft Sentinel to the Microsoft Defender portal, see:
- [Multiple Microsoft Sentinel workspaces in the Defender portal](/azure/sentinel/workspaces-defender-portal)
- [Microsoft Defender multitenant management](/defender-xdr/mto-overview)
-## Entering multiple workspace view
+
+## Enter multiple-workspace view
When you open Microsoft Sentinel, you're presented with a list of all the workspaces to which you have access rights, across all selected tenants and subscriptions. Selecting the name of a single workspace brings you into that workspace. To choose multiple workspaces, select all the corresponding checkboxes, and then select the **View incidents** button at the top of the page.
@@ -36,9 +39,10 @@ In the list of workspaces, you can see the directory, subscription, location, an
:::image type="content" source="./media/multiple-workspace-view/workspaces.png" alt-text="Screenshot of selecting multiple workspaces.":::
-## Working with incidents
+
+## Work with incidents across workspaces
-Multiple workspace view is currently available only for incidents. This page looks and functions in most ways like the regular [Incidents](investigate-cases.md) page, with the following important differences:
+Multiple workspace view is currently available only for incidents. The multiple workspace view incidents page looks and functions in most ways like the regular [Incidents](investigate-cases.md) page, with the following important differences:
:::image type="content" source="./media/multiple-workspace-view/incidents.png" alt-text="Screenshot of viewing incidents across multiple workspaces." lightbox="./media/multiple-workspace-view/incidents.png":::
@@ -51,9 +55,8 @@ Multiple workspace view is currently available only for incidents. This page loo
- If you choose a single incident and select **View full details** or **Actions** > **Investigate**, you'll from then on be in the data context of that incident's workspace and no others.
-## Next steps
+
+## Related content
-In this article, you learned how to view and work with incidents in multiple Microsoft Sentinel workspaces concurrently. To learn more about Microsoft Sentinel, see the following articles:
-
-- Learn how to [get visibility into your data, and potential threats](get-visibility.md).
-- Get started [detecting threats with Microsoft Sentinel](detect-threats-built-in.md).
+- [Get visibility into your data and potential threats](get-visibility.md)
+- [Detect threats with Microsoft Sentinel](detect-threats-built-in.md)
diff --git a/sentinel/near-real-time-rules.md b/sentinel/near-real-time-rules.md
index 3b3b05a2270..6a0dd3c0fda 100644
--- a/sentinel/near-real-time-rules.md
+++ b/sentinel/near-real-time-rules.md
@@ -1,5 +1,5 @@
---
-title: Quick threat detection with near-real-time (NRT) analytics rules in Microsoft Sentinel | Microsoft Docs
+title: Quick threat detection with near-real-time (NRT) analytics rules in Microsoft Sentinel
description: This article explains how the new near-real-time (NRT) analytics rules can help you detect threats quickly in Microsoft Sentinel.
ms.author: guywild
author: guywi-ms
diff --git a/sentinel/normalization-about-parsers.md b/sentinel/normalization-about-parsers.md
index 7b5ae1a2f68..5a9ccef880b 100644
--- a/sentinel/normalization-about-parsers.md
+++ b/sentinel/normalization-about-parsers.md
@@ -1,5 +1,5 @@
---
-title: Use Advanced Security Information Model (ASIM) parsers | Microsoft Docs
+title: Use Advanced Security Information Model (ASIM) parsers
description: This article explains how to use Kusto Query Language (KQL) functions as query-time parsers to implement the Advanced Security Information Model (ASIM)
ms.author: edbaynash
author: EdB-MSFT
@@ -74,4 +74,4 @@ The [parsers list](normalization-parsers-list.md) article notes parsers that sup
- [ASIM parsers overview](normalization-parsers-overview.md)
- [Manage ASIM parsers](normalization-manage-parsers.md)
-- [Develop custom ASIM parsers](isv/normalization-develop-parsers.md)
+- [Develop custom ASIM parsers](normalization-develop-parsers.md)
diff --git a/sentinel/normalization-about-schemas.md b/sentinel/normalization-about-schemas.md
index 541a7b40684..b821fed1071 100644
--- a/sentinel/normalization-about-schemas.md
+++ b/sentinel/normalization-about-schemas.md
@@ -1,5 +1,5 @@
---
-title: Advanced Security Information Model (ASIM) schemas | Microsoft Docs
+title: Advanced Security Information Model (ASIM) schemas
description: This article explains Advanced Security Information Model (ASIM) schemas, and how they help. ASIM normalizes data from many different sources to a uniform presentation.
ms.author: edbaynash
author: EdB-MSFT
diff --git a/sentinel/normalization-about-workspace-parsers.md b/sentinel/normalization-about-workspace-parsers.md
index 7e97f8c2f28..f395c611bf0 100644
--- a/sentinel/normalization-about-workspace-parsers.md
+++ b/sentinel/normalization-about-workspace-parsers.md
@@ -110,4 +110,4 @@ For example, the following code shows a DNS filtering unifying parser, having re
- [ASIM parsers overview](normalization-parsers-overview.md)
- [Manage ASIM parsers](normalization-manage-parsers.md)
-- [Develop custom ASIM parsers](isv/normalization-develop-parsers.md)
+- [Develop custom ASIM parsers](normalization-develop-parsers.md)
diff --git a/sentinel/normalization-common-fields.md b/sentinel/normalization-common-fields.md
index fd91fbd3f7c..23cd7112306 100644
--- a/sentinel/normalization-common-fields.md
+++ b/sentinel/normalization-common-fields.md
@@ -1,5 +1,5 @@
---
-title: The Advanced Security Information Model (ASIM) common schema fields reference | Microsoft Docs
+title: The Advanced Security Information Model (ASIM) common schema fields reference
description: This article describes the Advanced Information Security (ASIM) common schema fields
ms.author: edbaynash
author: EdB-MSFT
diff --git a/sentinel/normalization-content.md b/sentinel/normalization-content.md
index 27b7c476eb1..b699ee3fb5b 100644
--- a/sentinel/normalization-content.md
+++ b/sentinel/normalization-content.md
@@ -1,5 +1,5 @@
---
-title: Advanced Security Information Model (ASIM) security content | Microsoft Docs
+title: Advanced Security Information Model (ASIM) security content
description: This article outlines the Microsoft Sentinel security content that uses the Advanced Security Information Model (ASIM).
ms.author: edbaynash
author: EdB-MSFT
diff --git a/sentinel/isv/normalization-create-parsers-ai-agent.md b/sentinel/normalization-create-parsers-ai-agent.md
similarity index 95%
rename from sentinel/isv/normalization-create-parsers-ai-agent.md
rename to sentinel/normalization-create-parsers-ai-agent.md
index 5011cb16d2f..2ebaa4a9dcc 100644
--- a/sentinel/isv/normalization-create-parsers-ai-agent.md
+++ b/sentinel/normalization-create-parsers-ai-agent.md
@@ -98,6 +98,10 @@ The `asim-parser-create-parameter-parser` skill creates a second version of the
After creation, the parameterized parser goes through the same validation and refinement loop described in the [Validation](#validation) and [Refinement loop](#refinement-loop) sections.
+### Parameterized filter validation
+
+The `asim-parser-filter-validator` skill verifies that the parameterized parser's filtering parameters behave correctly. It runs a PowerShell-based test suite against your Log Analytics workspace that checks each parameter declared in the parser's KQL function signature.
+
### Deployment or packaging
After both parsers are validated, you choose what to do next:
@@ -129,6 +133,7 @@ We highly recommend submitting your parsers as a pull request to the [Azure-Sent
- For more information about the skills, you can refer to the skills folder in the [Azure-Sentinel](https://github.com/Azure/Azure-Sentinel/tree/master/.github/skills) repository.
- The [ASIM parser agent README](https://github.com/Azure/Azure-Sentinel/blob/master/ASIM/tools/ASIMParserCreation-Agentic/README.md) in the repository also provides troubleshooting guidance.
+- [Develop ASIM parsers](/azure/sentinel/normalization-develop-parsers) provides detailed guidance on manually developing and testing ASIM parsers.
## Getting Help
diff --git a/sentinel/isv/normalization-develop-parsers.md b/sentinel/normalization-develop-parsers.md
similarity index 89%
rename from sentinel/isv/normalization-develop-parsers.md
rename to sentinel/normalization-develop-parsers.md
index 1c1f1970566..05b6bf06edd 100644
--- a/sentinel/isv/normalization-develop-parsers.md
+++ b/sentinel/normalization-develop-parsers.md
@@ -1,10 +1,12 @@
---
-title: Develop Microsoft Sentinel Advanced Security Information Model (ASIM) parsers | Microsoft Docs
+title: Develop Microsoft Sentinel Advanced Security Information Model (ASIM) parsers
description: This article explains how to develop, test, and deploy Microsoft Sentinel Advanced Security Information Model (ASIM) parsers.
ms.author: edbaynash
author: EdB-MSFT
ms.topic: how-to
-ms.date: 11/09/2021
+ms.date: 06/15/2026
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1014
#Customer intent: As a security analyst, I want to develop custom ASIM parsers so that I can normalize and analyze security event data from various sources in a consistent format.
@@ -27,7 +29,7 @@ Microsoft Sentinel provides built-in, source-specific parsers for many data sour
- The events might be collected, modified, and forwarded by an intermediary system.
-To understand how parsers fit within the ASIM architecture, refer to the [ASIM architecture diagram](../normalization.md#asim-components).
+To understand how parsers fit within the ASIM architecture, refer to the [ASIM architecture diagram](normalization.md#asim-components).
## Custom ASIM parser development process
@@ -35,21 +37,21 @@ The following workflow describes the high level steps in developing a custom ASI
1. [Collect sample logs](#collect-sample-logs).
-1. Identify the schemas or schemas that the events sent from the source represent. For more information, see [Schema overview](../normalization-about-schemas.md).
+1. Identify the schemas or schemas that the events sent from the source represent. For more information, see [Schema overview](normalization-about-schemas.md).
-1. [Map](#planning-mapping) the source event fields to the identified schema or schemas.
+1. [Map source events to the schema](#planning-mapping) for the identified schema or schemas.
-1. [Develop](#developing-parsers) one or more ASIM parsers for your source. You'll need to develop a filtering parser and a parameter-less parser for each schema relevant to the source.
+1. [Develop ASIM parsers](#developing-parsers) for your source. You'll need to develop a filtering parser and a parameter-less parser for each schema relevant to the source.
-1. [Test](#test-parsers) your parser.
+1. [Test your parser](#test-parsers).
-1. [Deploy](#deploy-parsers) the parsers into your Microsoft Sentinel workspaces.
+1. [Deploy the parsers](#deploy-parsers) into your Microsoft Sentinel workspaces.
-1. Update the relevant ASIM unifying parser to reference the new custom parser. For more information, see [Managing ASIM parsers](../normalization-manage-parsers.md).
+1. Update the relevant ASIM unifying parser to reference the new custom parser. For more information, see [Managing ASIM parsers](normalization-manage-parsers.md).
1. You might also want to [contribute your parsers](#contribute-parsers) to the primary ASIM distribution. Contributed parsers may also be made available in all workspaces as built-in parsers.
-This article guides you through the process's development, testing, and deployment steps.
+The following sections describe how to develop, test, and deploy custom ASIM source-specific parsers.
### Collect sample logs
@@ -67,9 +69,10 @@ A representative set of logs should include:
>
-## Planning mapping
+
+## Plan field mappings
-Before you develop a parser, map the information available in the source event or events to the schema you identified:
+Before you develop a parser, map the source event fields to the target ASIM schema or schemas selected for your source:
- Map all mandatory fields and preferably also recommended fields.
- Try to map any information available from the source to normalized fields. If not available as part of th selected schema, consider mapping to fields available in other schemas.
@@ -85,7 +88,10 @@ A custom parser is a KQL query developed in the Microsoft Sentinel **Logs** page
**Filter** > **Parse** > **Prepare fields**
-### Filtering
+
+### Filter relevant source records
+
+Filtering ensures that your parser selects only the source records relevant to the target schema, which is the first step in the parser query pipeline.
#### Filtering the relevant records
@@ -108,7 +114,7 @@ Event | where Source == "Microsoft-Windows-Sysmon" and EventID == 1
In some cases, the event itself does not contain information that would allow filtering for specific source types.
-For example, Infoblox DNS events are sent as Syslog messages, and are hard to distinguish from Syslog messages sent from other sources. In such cases, the parser relies on a list of sources that defines the relevant events. This list is maintained in the [**Sources_by_SourceType**](../normalization-manage-parsers.md#configure-the-sources-relevant-to-a-source-specific-parser) watchlist.
+For example, Infoblox DNS events are sent as Syslog messages, and are hard to distinguish from Syslog messages sent from other sources. In such cases, the parser relies on a list of sources that defines the relevant events. This list is maintained in the [**Sources_by_SourceType**](normalization-manage-parsers.md#configure-the-sources-relevant-to-a-source-specific-parser) watchlist.
To use the ASimSourceType watchlist in your parsers, use the `_ASIM_GetSourceBySourceType` function in the parser filtering section. For example, the Infoblox DNS parser includes the following in the filtering section:
@@ -124,11 +130,11 @@ To use this sample in your parser:
#### Filtering based on parser parameters
-When developing [filtering parsers](../normalization-about-parsers.md#optimizing-parsing-using-parameters), make sure that your parser accepts the filtering parameters for the relevant schema, as documented in the reference article for that schema. Using an existing parser as a starting point ensures that your parser includes the correct function signature. In most cases, the actual filtering code is also similar for filtering parsers for the same schema.
+When developing [filtering parsers](normalization-about-parsers.md#optimizing-parsing-using-parameters), make sure that your parser accepts the filtering parameters for the relevant schema, as documented in the reference article for that schema. Using an existing parser as a starting point ensures that your parser includes the correct function signature. In most cases, the actual filtering code is also similar for filtering parsers for the same schema.
When filtering, make sure that you:
-- **Filter before parsing using physical fields**. If the filtered results are not accurate enough, repeat the test after parsing to fine-tune your results. For more information, see [filtering optimization](#optimization).
+- **Filter before parsing using physical fields**. If the filtered results are not accurate enough, repeat the test after parsing to fine-tune your results. For more information, see [optimize filtering performance](#optimization).
- **Do not filter if the parameter is not defined and still has the default value**.
The following examples show how to implement filtering for a string parameter, where the default value is usually '\*', and for a list parameter, where the default value is usually an empty list.
@@ -164,7 +170,8 @@ Syslog | where ProcessName == "named" and SyslogMessage has "client"
> Parsers should not filter by time, as the query using the parser already filters for time.
>
-### Parsing
+
+### Parse source data into ASIM fields
Once the query selects the relevant records, it may need to parse them. Typically, parsing is needed if multiple event fields are conveyed in a single text field.
@@ -181,7 +188,10 @@ The KQL operators that perform parsing are listed below, ordered by their perfor
| [parse_json()](/kusto/query/parse-json-function) function | Parse the values in a string formatted as JSON. If only a few values are needed from the JSON, using `parse`, `extract`, or `extract_all` provides better performance. |
| [parse_xml()](/kusto/query/parse-xml-function) function | Parse the values in a string formatted as XML. If only a few values are needed from the XML, using `parse`, `extract`, or `extract_all` provides better performance. |
-### Normalizing
+
+### Normalize fields to the ASIM schema
+
+Normalization converts source field names, values, and formats to the standard ASIM schema representation, ensuring consistency across data sources.
#### Mapping field names
@@ -258,9 +268,9 @@ Microsoft Sentinel provides handy functions for common lookup values. For exampl
| invoke _ASIM_ResolveDnsResponseCode('DnsResponseCode')
```
-The first option accepts as a parameter the value to look up and let you choose the output field and therefore useful as a general lookup function. The second option is more geared towards parsers, takes as input the name of the source field, and updates the needed ASIM field, in this case `DnsResponseCodeName`.
+`_ASIM_LookupDnsResponseCode` accepts the value to look up as a parameter and lets you choose the output field, making it useful as a general lookup function. `_ASIM_ResolveDnsResponseCode` is more geared toward parsers: it takes the name of the source field as input and updates the needed ASIM field, in this case `DnsResponseCodeName`.
-For a full list of ASIM help functions, refer to [ASIM functions](../normalization-functions.md)
+For a full list of ASIM help functions, refer to [ASIM functions](normalization-functions.md)
#### Enrichment fields
@@ -276,7 +286,7 @@ In addition to the fields available from the source, a resulting ASIM event incl
EventSchema = 'ProcessEvent'
```
-Another type of enrichment fields that your parsers should set are type fields, which designate the type of the value stored in a related field. For example, the `SrcUsernameType` field designates the type of value stored in the `SrcUsername` field. You can find more information about type fields in the [entities description](../normalization-about-schemas.md#event-entities).
+Another type of enrichment fields that your parsers should set are type fields, which designate the type of the value stored in a related field. For example, the `SrcUsernameType` field designates the type of value stored in the `SrcUsername` field. You can find more information about type fields in the [entities description](normalization-about-schemas.md#event-entities).
In most cases, types are also assigned a constant value. However, in some cases the type has to be determined based on the actual value, for example:
@@ -298,7 +308,7 @@ This function will set the fields as follows:
| server1.microsoft.com | SrcHostname: server1
SrcDomain: microsoft.com
SrcDomainType: FQDN
SrcFQDN:server1.microsoft.com |
-The functions `_ASIM_ResolveDstFQDN` and `_ASIM_ResolveDvcFQDN` perform a similar task populating the related `Dst` and `Dvc` fields. For a full list of ASIM help functions, refer to [ASIM functions](../normalization-functions.md)
+The functions `_ASIM_ResolveDstFQDN` and `_ASIM_ResolveDvcFQDN` perform a similar task populating the related `Dst` and `Dvc` fields. For a full list of ASIM help functions, refer to [ASIM functions](normalization-functions.md)
### Select fields in the result set
@@ -439,7 +449,7 @@ Handle the results as follows:
| Message | Action |
| ------- | ------ |
| **(0) Error: type mismatch for column [\]. It is currently [\] and should be [\]** | Make sure that the type of normalized field is correct, usually by using a [conversion function](/kusto/query/scalar-functions?view=microsoft-sentinel&preserve-view=true#conversion-functions) such as `tostring`. |
-| **(0) Error: Invalid value(s) (up to 10 listed) for field [\] of type [\