The Curious Engineer

All blogs / Security

Microsoft Defender XDR Blog

techcommunity.microsoft.com/category/microsoft-defender-xdr/blog/microsoftthreatprotectionblog

SecurityMicrosoft blogsMicrosoft Tech Community

’20’21’22’23’24’25’26
Posts
296 from 1 Jul 2020 to 29 Oct 2026
Posting
weekly (32 in the last year)
Kind
company blog

2026 25

  1. Now generally available: Discover local AI agents with Microsoft Defender
  2. Turn threat intelligence into informed action with Microsoft Defender
  3. Integrated Security Operations Center in Microsoft Defender
  4. Reimagining Case Management in Microsoft Defender
  5. Stop identity attacks before they start with Microsoft ISPM recommendations
  6. Monthly News-August 2026
  7. Detecting CVE-2026-54121 (Certighost) with Microsoft Defender
  8. MDTI convergence in Microsoft Sentinel and Defender XDR is complete
  9. Microsoft Defender now integrates with Dragos, Forescout, & Armis for OT Security
  10. Monthly news - July 2026
  11. Securing the invisible workforce
  12. The next frontier in endpoint security: Securing local AI agents with Microsoft Defender
  13. Organize your multitenant view with Tenant Groups in Microsoft Defender
  14. Monthly news - May 2026
  15. Microsoft Defender: New Advanced hunting enhancements
  16. Monthly news - April 2026
  17. Redefining identity security for the modern enterprise
  18. RSA 2026: What’s new in Microsoft Defender?
  19. Security Copilot in Defender: empowering the SOC with assistive and autonomous AI
  20. Monthly news - March 2026
  21. From signal to strategy: Closing attack paths with identity intelligence
  22. Monthly news - February 2026
  23. Monthly news - January 2026
  24. Introducing AI-powered incident prioritization in Microsoft Defender
  25. Announcing public preview: Uncovering hidden threats with the Dynamic Threat Detection Agent

2025 52

  1. Monthly news - December 2025
  2. What’s New at Ignite: Powerful Enhancements in Unified Threat Intelligence
  3. Ignite 2025: What's new in Microsoft Defender?
  4. Security Copilot for SOC: bringing agentic AI to every defender
  5. Enhancing visibility into your identity fabric with Microsoft Defender
  6. Detect more, spend less: the future of threat intelligence correlation
  7. Monthly news - November 2025
  8. Custom detections are now the unified experience for creating detections in Microsoft Defender
  9. Announcing General Availability: Unified identity and endpoint sensor
  10. How Microsoft Defender helps security teams detect prompt injection attacks in Microsoft 365 Copilot
  11. Host Microsoft Defender data locally in the United Arab Emirates
  12. Monthly news - October 2025
  13. Protect Copilot Studio AI Agents in Real Time with Microsoft Defender
  14. Protect against OAuth Attacks in Salesforce with Microsoft Defender
  15. Custom detection rules get a boost—explore what’s new in Microsoft Defender
  16. Monthly news - September 2025
  17. Leaving the key under the doormat: How Microsoft Defender uses AI to spot exposed credentials
  18. Monthly news - August 2025
  19. Announcing Public Preview: Phishing Triage Agent in Microsoft Defender
  20. Discover risks in AI model providers and MCP servers with Microsoft Defender
  21. MDTI is Converging into Microsoft Sentinel and Defender XDR
  22. Discover and govern ChatGPT and other AI apps accessing Microsoft 365 with Defender for Cloud Apps
  23. Monthly news - July 2025
  24. Case management now supports multiple tenants in Microsoft Defender experience
  25. Introducing TITAN-Powered Recommendations in Security Copilot Guided Response
  26. Scope Identity Protection with Defender for Identity is Now Generally Available
  27. Microsoft Defender for Identity extends ITDR capabilities to Okta identities
  28. Monthly news - June 2025
  29. Expanding the Identity perimeter: the rise of non-human identities
  30. From on-premises to cloud: Graph-powered detection of hybrid attacks with Microsoft exposure graph
  31. The Best of Microsoft Sentinel — Now in Microsoft Defender
  32. Announcing File Attachments for Case Management
  33. Monthly news - May 2025
  34. Unified Security Summary: Enhancing Visibility and Value
  35. Empowering SOC Analysts: Investigating Identity Threats with Microsoft Defender XDR
  36. Expanding Cross Cloud Multitenant Security Operations for Government Customers
  37. Announcing Rich Text for Case Management
  38. Automatic attack disruption: Enhanced containment for critical assets and shadow IT
  39. Monthly news - April 2025
  40. Introducing the Threat Intelligence Briefing Agent
  41. What’s new in Microsoft Defender XDR at Secure 2025
  42. Protect SaaS apps from OAuth threats with attack path, advanced hunting and more
  43. Discover and protect Service Accounts with Microsoft Defender for Identity
  44. Level up your defense: protect against attacks using stale user accounts
  45. Defending Against OAuth-Based Attacks with Automatic Attack Disruption
  46. Monthly news - March 2025
  47. Monthly news - February 2025
  48. Get visibility into your DeepSeek use with Defender for Cloud Apps
  49. Securing Identities: 10 recommendations for building a stronger identity security posture
  50. Case management to improve SecOps Collaboration
  51. Introducing the new Defender for Identity sensor management API
  52. Monthly news - January 2025

2024 56

  1. Hyperscale ML threat intelligence for early detection & disruption
  2. Monthly news - December 2024
  3. New at Ignite: TI Guided Experience in Security Copilot
  4. New at Ignite: Unified Threat Intelligence Experience in Security Copilot
  5. Ignite news: What's new in Microsoft Defender XDR?
  6. Ignite news: Seamless protection for your on-prem identities with Defender for Identity
  7. Ignite news: Secure your SaaS landscape with the latest Defender for Cloud Apps innovations
  8. Security Copilot: A game changer for modern SOC
  9. Monthly news - November 2024
  10. Demystify potential data leaks with Insider Risk Management insights in Defender XDR
  11. Monthly news - October 2024
  12. New Security Copilot Plugin Name Reflects Broader Capabilities
  13. MDTI for Government Now Available
  14. AI-Driven Guided Response for SOCs with Microsoft Copilot for Security
  15. New Security Copilot skill: Identity Summary
  16. Detecting browser anomalies to disrupt attacks early
  17. Defender for Identity: the critical role of identities in automatic attack disruption
  18. Unlocking Real-World Security: Defending against Crypto mining attacks
  19. Monthly news - September 2024
  20. Protect and Detect: Microsoft Defender for Identity Expands to Entra Connect Server
  21. Defender for Identity PowerShell module update
  22. Introducing the MDTI Home Page Widget and Article Digest
  23. Host Microsoft Defender data locally in India
  24. Introducing the MDTI Premium Data Connector for Sentinel
  25. Cybersecurity incident correlation in the unified security operations platform
  26. Monthly news - August 2024
  27. Make OT security a core part of your SOC strategy with Microsoft Defender XDR
  28. Monthly news - August 2024
  29. More Threat Intelligence Content In MDTI, TA Enables Better Security Outcomes
  30. Copilot for Security TI Embedded Experience in Defender XDR is now GA
  31. Microsoft Defender for Cloud Apps’ Shadow IT Discovery Capabilities Now Support MacOS
  32. Monthly news - June 2024
  33. Easily detect CVE-2024-21427 with Microsoft Defender for Identity
  34. Host Microsoft Defender data locally in Switzerland
  35. Defender for Cloud Apps delivers new in-browser protection capabilities via Microsoft Edge
  36. Monthly news - May 2024
  37. RSA news: What's new in Defender XDR?
  38. Introducing the new Defender for Identity Health Alert API
  39. MDTI Achieves PCI DSS Certification: Elevating Security Standards
  40. Monthly news - May 2024
  41. A Security Copilot Customer’s Guide to MDTI
  42. What’s new in Defender: How Copilot for Security can transform your SOC
  43. New at Secure: Corpus of Intel Profiles Available in Defender XDR
  44. New at Secure: Enhanced Vulnerability Profiles and CVE Search within MDTI
  45. New at Secure: MDTI in Defender XDR Global Search
  46. What's New at Microsoft Secure 2024
  47. MDTI Standalone Portal Retirement and Transition to Defender XDR
  48. Monthly news - March 2024
  49. MDTI Earns Impactful Trio of ISO Certificates
  50. Managing MDTI Premium licenses in Microsoft Entra Admin Center
  51. Monthly news - May 2024
  52. Protect faster with Microsoft Defender XDR’s latest UX enhancements
  53. Introducing the new PowerShell Module for Microsoft Defender for Identity
  54. Identity in focus: Exploring the new ITDR experience in the Defender portal
  55. Introducing Automatic File and URL (Detonation) Analysis
  56. Monthly news - January 2024

2023 65

  1. MDTI Adds Microsoft Threat Intelligence to Silobreaker
  2. Securing AD CS: Microsoft Defender for Identity's Sensor Unveiled
  3. Microsoft Defender XDR unified role-based access control (RBAC) model is now generally available
  4. Discover, monitor and protect the use of Generative AI apps
  5. Monthly news - December 2023
  6. Get email notifications for any actions in Defender XDR
  7. Unified MDTI APIs in Microsoft Graph Now GA
  8. How MDTI Helps Power Copilot for Security
  9. Introducing MDTI Free Experience for Microsoft Defender XDR
  10. What's New at Microsoft Ignite 2023
  11. Ignite news: XDR in an era of end-user-to-cloud cyberattacks and securing the use of AI
  12. Using MDTI with the Diamond Model for Threat Intelligence
  13. Enterprise IoT security is now included in Microsoft 365 E5 and E5 Security plans
  14. Monthly news - November 2023
  15. Simplified deployment with Defender for Identity
  16. Operationalizing Microsoft Security Copilot to Reinvent SOC Productivity
  17. Using advanced hunting to secure OAuth apps
  18. Monthly news - December 2023
  19. Enriching Anomali and Other TIPS with MDTI Feeds
  20. Respond to threats across tenants more effectively with Microsoft Defender XDR multi-tenant support
  21. Monthly news - December 2023
  22. Microsoft Defender for Identity expands its coverage with new AD CS sensor!
  23. Monthly news - December 2023
  24. Unleash the Power of Threat Intel: Introducing the MDTI GitHub
  25. Investigate URLs and domains more efficiently with the new URL page
  26. Microsoft empowers partners to securely build their own connector on its Open App Connector Platform
  27. New file analysis and pivoting capabilities in Microsoft 365 Defender
  28. Deceptive defense: best practices for identity based honeytokens in Microsoft Defender for Identity
  29. Leveraging the convergence of Microsoft Defender for Identity in Microsoft 365 Defender Portal
  30. Monthly news - July 2023
  31. Share your feedback via the new feedback portal
  32. New Threat Actor Intel Profiles Added to MDTI
  33. Prevent repeat attacks with threat-informed security posture recommendations
  34. Monthly news - June 2023
  35. Safeguarding your OAuth apps with App Governance
  36. Transform the way you investigate by using Behaviors & new detections in XDR, starting w/SaaS apps
  37. Boost your detection and response workflows with alert tuning
  38. Automatically disrupt adversary-in-the-middle (AiTM) attacks with XDR
  39. What's New: MDTI Intel Reporting Dashboard and Workbook
  40. What’s New: MDTI Interoperability with Microsoft 365 Defender
  41. Monthly news - January 2023
  42. RSA News: Taking XDR for SaaS apps to the next level - App Governance is now included in E5 Security
  43. What's New: Hash and URL Search Intelligence
  44. Simplifying SaaS Security: Deploying Microsoft Defender for Cloud Apps in 4 steps
  45. Monthly news - May 2023
  46. Monthly news - April 2023
  47. What's New: APIs in Microsoft Graph
  48. What's New: MDTI Microsoft Sentinel Playbooks
  49. What's New: Intel Profiles Deliver Crucial Information, Context About Threats
  50. What's New at Microsoft Secure
  51. Announcing Collaboration Security for Microsoft Teams
  52. Respond to threats in near real-time with custom detections
  53. XDR attack disruption in action – Defending against a recent BEC attack
  54. Monthly news - May 2023
  55. Monthly news - May 2024
  56. Microsoft Defender for Identity now detects suspicious certificate usage
  57. Improve your app posture and hygiene using Microsoft Defender for Cloud Apps
  58. Performing a Successful Proof of Concept (PoC)
  59. Monthly news - May 2023
  60. Automate your alert response actions in Microsoft 365 Defender
  61. Defender for Cloud and MDTI are Better Together
  62. Build custom incident response actions with Microsoft 365 Defender APIs
  63. Centrally manage permissions with the Microsoft 365 Defender role-based access control (RBAC) model
  64. Monthly news - January 2023
  65. Protect your sensitive data against malicious apps

2022 47

  1. Protect your sensitive data against malicious apps
  2. Protect apps that use non-standard ports with Defender for Cloud Apps
  3. Infrastructure Chaining with Microsoft Defender Threat Intelligence
  4. Monthly news - November 2022
  5. Microsoft Defender for Cloud Apps data protection series: Understand your data types
  6. Defender TI Empowers Organizations to Get More Done With Less
  7. Investigate incidents more effectively with the new attack story view in Microsoft 365 Defender
  8. Monthly news - October 2022
  9. Introducing the Microsoft Defender for Cloud Apps data protection series
  10. Become an MDTI Ninja: The complete level 400 training
  11. What's in an MDTI Web Crawl?
  12. Introducing the Microsoft Defender Threat Intelligence Community
  13. Understanding and Using Finished Threat Intelligence
  14. Getting the Most Out of Projects in Defender TI
  15. Using Reputation and Analyst Insights Features For Quick Indicator Assessments
  16. Microsoft Defender Threat Intelligence Overview, Concepts, and Vocabulary
  17. Getting Started with Microsoft Defender Threat Intelligence
  18. Defender TI Detections in Microsoft Sentinel
  19. Get to Know the Datasets and How to Use Them During Investigations
  20. Exploring Target User Functions and Use Cases
  21. How Internet Telemetry Data Becomes Threat Intelligence
  22. We Are Pleased To Introduce the Microsoft Defender Threat Intelligence Ninja Training Series!
  23. Identity Protection alerts now available in Microsoft 365 Defender
  24. Identity Protection alerts now available in Microsoft 365 Defender
  25. How Microsoft Defender Threat Intelligence Enables Threat Hunting Success
  26. Welcome to the Microsoft Defender Threat Intelligence Tech Community
  27. Protect your environment against hybrid identity attacks
  28. Monthly news - September 2022
  29. Monthly news - September 2022
  30. Top Threat Protection use cases in Microsoft Defender for Cloud Apps
  31. Monthly news - August 2022
  32. Hunt in Microsoft 365 Defender without KQL!
  33. Hunt for compromised Azure subscriptions using Microsoft Defender for Cloud Apps
  34. The new Microsoft 365 Defender APIs in Microsoft Graph are now available in public preview!
  35. Protect sensitive SharePoint sites with Defender for Cloud Apps
  36. Short & sweet educational videos on Microsoft Defender XDR
  37. Monthly news - June 2022
  38. Microsoft Defender for Cloud Apps experiences are now part of Microsoft 365 Defender
  39. New URL & domain pages in Microsoft 365 Defender
  40. The power of incidents in Microsoft 365 Defender
  41. Microsoft 365 Defender Streaming API: Identity and CloudApp Events in General Availability
  42. Introducing predefined policies in app governance
  43. Detecting and Remediating Impossible Travel
  44. What’s new: Unified Microsoft SIEM & XDR GitHub community
  45. New and improved incident queue
  46. Reduce time to response with classification
  47. The new, fully supported, Splunk Add-on for Microsoft Security is available

2021 27

  1. CloudAppEvents in advanced hunting now includes non-Microsoft apps and new data columns
  2. Protect printers, cameras and the rest of your IoT devices with Microsoft 365 Defender
  3. Using gMSA account in Microsoft Defender for Identity in multi-domain forests.
  4. Announcing the new advanced hunting page and link to incident feature
  5. Assign incidents and alerts to someone else
  6. New Incident Graph view in Microsoft 365 Defender
  7. Advanced Hunting: Surfacing more email data from Microsoft Defender for Office 365
  8. Microsoft 365 Defender Ninja August 2021 special edition!
  9. Microsoft 365 Defender Ninja Training: August 2021 update
  10. Take your security to the next level with professional security services
  11. New webinar series: Monthly threat insights
  12. Announcing Microsoft 365 Defender Streaming API Public Preview
  13. New alert page for Microsoft 365 Defender incident detections!
  14. Microsoft Defender for Identity native alert page in Microsoft 365 Defender
  15. Microsoft Cloud App Security: The Hunt for Insider Risk
  16. Easily find anomalies in incidents and alerts
  17. Blog Series: Limitless Advanced Hunting with Azure Data Explorer (ADX)
  18. Best practices for leveraging Microsoft 365 Defender API's - Episode Three
  19. Unified experiences across endpoint and email are now generally available in Microsoft 365 Defender
  20. Launching threat analytics for Microsoft 365 Defender
  21. Azure Sentinel and Microsoft 365 Defender incident integration
  22. Best practices for leveraging Microsoft 365 Defender API's - Episode Two
  23. Microsoft Cloud App Security: The Hunt in a multi-stage incident
  24. Microsoft 365 Defender now delivers unified experiences across endpoint, email and collaboration
  25. Microsoft 365 Defender Ninja Training: January 2021 update
  26. Best practices for leveraging Microsoft 365 Defender API's - Episode One
  27. Hunt for Azure Active Directory sign-in events

2020 24

  1. Get email notifications on new incidents from Microsoft 365 Defender
  2. Advanced hunting product name changes
  3. New Threat analytics report shares the latest intelligence on recent nation-state cyber attacks
  4. Azure Active Directory audit logs now available in Advanced Hunting (public preview)
  5. Additional email data in advanced hunting
  6. Microsoft Defender for Office 365 investigation improvements coming soon
  7. Hunt across cloud app activities with Microsoft 365 Defender advanced hunting
  8. Microsoft 365 Defender connector now in Public Preview for Azure Sentinel
  9. Improved incident queue in Microsoft 365 Defender
  10. Become a Microsoft Defender Ninja
  11. ZeroLogon is now detected by Microsoft Defender for Identity (CVE-2020-1472 exploitation)
  12. Self-healing in Microsoft 365 Defender
  13. Say hello to the new Microsoft Threat Protection APIs!
  14. Microsoft Threat Protection now uses more descriptive incident names
  15. Hunt for threats using events captured by Azure ATP on your domain controller
  16. On-demand webcast series: “Tracking the adversary”
  17. Pull in more intelligence and act fast while you hunt
  18. See how consolidated incidents improve SOC efficiency through this attack sprawl simulation
  19. The Action center in Microsoft Threat Protection – Your one-stop shop for remediation actions
  20. Pivot fast and investigate freely with go hunt & other advanced hunting enhancements
  21. Short & sweet educational videos on Microsoft Defender XDR
  22. Webinar series: Unleash the hunter in you!
  23. Microsoft Threat Protection advanced hunting cheat sheet
  24. Welcome to the new community home for Microsoft Threat Protection (MTP)