Manage security and threats using Microsoft Defender XDR

3.1 Review & respond to security reports and alerts

Exposure Management & Microsoft Secure Score

Microsoft Secure Score measures security posture as a percentage = points achieved ÷ points achievable. Improvement actions are grouped by product: Identity (Entra), Devices (Defender for Endpoint), Apps (O365 / Cloud Apps), and Data. A higher score means stronger posture.

• Actions can award partial points proportional to coverage (e.g. MFA registered for 60% of users = 60% of that action's points).
• Each action lists user impact and implementation effort; score data refreshes roughly every 24 hours.
• Metrics & trends shows score history and benchmarks against organisations of similar size, your industry, and globally.
• Security Exposure Management extends Secure Score with attack-surface mapping, attack paths to critical assets, critical asset management, and security initiatives that bundle recommendations by program (e.g. ransomware protection).

Incidents & alerts

An alert is a single detection; an incident is the aggregation of all related alerts + affected assets (devices, users, mailboxes, apps) into one attack story. Defender XDR correlates automatically across products, so one click shows the full kill chain. Manage in security.microsoft.com → Incidents & alerts.

Incident management workflow:

• Triage by severity (High / Medium / Low / Informational), assign ownership, set status (Active → In progress → Resolved), add tags and comments.
• Classify when resolving: True positive (with a threat determination — malware, phishing, compromised account, etc.), False positive, or Benign positive (real but expected, e.g. a pen-test).
• Merge related incidents and link alerts; you can tune an alert / create a suppression rule to reduce noise from known-good activity.

Automated Investigation & Response (AIR) & the Action center

• AIR automatically investigates alerts, gathers evidence (files, processes, emails), determines verdicts, and proposes or takes remediation actions.
• Automation level (Defender for Endpoint device groups): Full = remediate automatically; Semi = require approval (several variants by folder/location); No automated response.
• Action center has two tabs — Pending (awaiting approval — approve/reject) and History (completed actions, with undo for reversible ones).

Advanced hunting (KQL)

Advanced hunting proactively queries up to 30 days of raw event data using KQL (Kusto Query Language). Two modes: Guided (visual query builder, no KQL needed) and Advanced (write KQL directly).

// KQL: emails that delivered a malicious attachment in last 7 days
EmailAttachmentInfo
| where Timestamp > ago(7d)
| where MalwareFilterVerdict == "Malware"
| join EmailEvents on NetworkMessageId
| project Timestamp, SenderFromAddress, RecipientEmailAddress, FileName, Subject

// KQL: devices that ran a specific suspicious process
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "cmd.exe")
| where ProcessCommandLine has "-enc"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp desc

Defender XDR reports

Know which report answers which question:

Threat analytics & Defender Threat Intelligence

Threat analytics is the in-product threat-intelligence dashboard written by Microsoft security researchers. Each threat analytics report covers an active campaign, technique or actor and ties it to your tenant:

• Overview / Analyst report — narrative, TTPs and detection details.
• Related incidents — incidents in your tenant attributed to this threat.
• Impacted assets — your devices/mailboxes affected.
• Exposure & mitigations — which recommended configurations you're missing and secure-score-style actions to close the gap.

Microsoft Defender Threat Intelligence (MDTI) goes deeper: searchable threat-actor profiles, IOCs (indicators of compromise — IPs, domains, hashes), and intelligence articles you can pivot from into hunting.

3.2 Email & collaboration protection — Defender for Office 365

Builds on Exchange Online Protection (EOP) — the always-on anti-malware/anti-spam baseline for all Exchange Online mailboxes. Defender for Office 365 adds advanced protection in two plans:

Threat policies & rules

Safe Attachments — actions

• Safe Attachments for SharePoint, OneDrive & Teams is a separate global toggle that detonates files already stored in those services.
• Global settings include "Turn on Safe Attachments for SharePoint/OneDrive/Teams" and the Safe Documents (Office) option (E5).

Safe Links — key settings

• Rewrites URLs and checks them at time of click (not just delivery) for email, Teams, and Office apps — protects against URLs weaponised after delivery.
• Settings: apply to email / Teams / Office apps, scan/wait for URL verdict before delivery, do not track / do not rewrite lists, block specific URLs, and don't let users click through to the original URL.
• The Tenant Allow/Block List URL entries override Safe Links verdicts.

Anti-phishing detail

• Spoof intelligence — detects forged senders of your own / external domains; review in the spoof intelligence insight and allow legitimate spoofers.
• Impersonation protection (P1+) — protect specific users (e.g. CEO), domains (your own + custom), and mailbox intelligence (learns each user's normal contacts).
• Advanced phishing thresholds: 1 Standard → 2 Aggressive → 3 More aggressive → 4 Most aggressive (higher = more mail treated as phish).
• Actions on detection: move to Junk, Quarantine, redirect, add safety tips / first-contact safety tip, unauthenticated-sender (?) indicator.

Anti-spam & anti-malware internals

Alert policies

Alert policies (Defender/Purview portal) trigger alerts on activities — e.g. malware campaign detected, unusual external file sharing, a user exceeding sending limits. Many default alert policies ship enabled. Each has a severity and can email recipients.

Investigate & respond to email/collab threats

• Threat Explorer (P2) / Real-time detections (P1): hunt across email by sender, URL, file, campaign; view detection technology and delivery location; take action — soft/hard delete, move to junk/inbox/deleted items, submit to Microsoft, trigger investigation.
• Email entity page: full detail on one message — headers, detonation results, URLs, all delivery/post-delivery events.
• Submissions portal: report false positives/negatives to Microsoft; admin submissions can auto-create Tenant Allow/Block List entries.
• Zero-hour Auto Purge (ZAP) retroactively moves already-delivered mail to junk/quarantine once a verdict changes.
• Campaign views (P2): group coordinated phishing/malware attacks and see the full message set + targeted users.

Quarantine & quarantine policies

Quarantine holds blocked messages. Quarantine policies control what end-users can do with their own quarantined items and whether they get notified:

Attack simulation training

Attack Simulation Training (Defender for O365 Plan 2) runs benign phishing campaigns to train users. Technique types: Credential Harvest, Malware Attachment, Link in Attachment, Link to Malware, Drive-by URL, OAuth Consent Grant.

• Assign training automatically to users who fall for the simulation; track a repeat-offender and predicted compromise rate.
• Review the simulation report — click rates, credential submission, training completion.

Restricted entities & blocked users

When a user is detected sending too much spam (likely compromised), they are added to Restricted entities and blocked from sending email. The admin investigates, secures the account (reset password, revoke sessions), then removes them from the restricted list to restore sending.

3.3 Endpoint protection — Defender for Endpoint

Onboarding devices

Microsoft Defender for Endpoint (MDE) is the EDR for devices. Onboarding methods depend on OS/management:

Configure endpoint settings & reduce attack surface

• Advanced features (Settings → Endpoints): toggles for Defender for Cloud Apps integration, Intune connection, automated investigation, "allow or block file", web content filtering, Tamper Protection, and Live Response.
• Attack Surface Reduction (ASR) rules — block common malware techniques (e.g. block Office apps creating child processes, block credential stealing from LSASS, block executable content from email/USB). Deploy via Intune/GPO and run in Audit before Block.
• Network protection (blocks malicious domains/IPs), Controlled folder access (anti-ransomware folder guard), Web content filtering, and EDR in block mode (remediates even when a third-party AV is primary).
• Device groups set RBAC scope + automation level + analyst visibility; tamper protection stops attackers/local admins disabling Defender.

Respond to threats on a device

From a device entity page (or via Live Response / custom detection), available response actions:

Defender Vulnerability Management (MDVM)

Microsoft Defender Vulnerability Management surfaces a device Exposure score and prioritised security recommendations, mapping software weaknesses (CVEs) to your devices in real time.

• Create a remediation request → flows to Intune as a task for the endpoint team (closes the loop between security and IT ops).
• Apply exceptions with justification & expiry when a recommendation can't be actioned.
• Inventories: software, browser extensions, certificates, firmware/hardware; plus security baselines assessment against CIS/STIG benchmarks.

3.4 Microsoft Defender for Cloud Apps

The CASB (Cloud Access Security Broker) — visibility & control over SaaS apps, shadow IT, and data in the cloud. It works across four stages:

App connector for Microsoft 365

App connectors use vendor APIs to connect sanctioned apps for deep visibility & governance. Connect the Microsoft 365 connector (one click, uses the same identity platform) to scan activity, files and apply governance to M365 data. App connectors give richer, ongoing control than Cloud Discovery — but they act after activity occurs (not in real time).

Conditional Access App Control (session & access policies)

Integrates with Entra Conditional Access to route sessions through Defender for Cloud Apps as a reverse proxy, enabling real-time controls:

• Session policies — monitor or limit within a live session: block download, block copy/paste/print, apply a sensitivity label, block upload of sensitive files (e.g. on an unmanaged device).
• Access policies — allow or block the sign-in to the app entirely based on device/user/location signals.

Policies & triggering alerts

Interpret the activity log

The activity log records every action (sign-ins, file ops, admin changes) ingested from connected apps. Filter by user, app, IP, location; pivot to investigate; promote a recurring pattern into an activity policy.

Cloud App Discovery & responding to findings

• Cloud Discovery analyses traffic logs (from firewalls/proxies, or continuously via Defender for Endpoint integration) to reveal shadow IT — apps employees use without IT approval.
• Each discovered app gets a risk score (0–10) based on ~90 risk factors (compliance, security, legal).
• Respond by tagging apps Sanctioned / Unsanctioned; unsanctioning (with MDE integration) can block the app on endpoints.