Windows Defender Advanced Threat Protection (ATP)
Protecting our enterprise customers has never been more challenging. Security threats are increasingly brazen and highly sophisticated. A new Windows 10 service that helps our customers to detect, investigate and respond to targeted and advanced attacks on their network.
Windows Defender Advanced Threat Protection
Windows Defender Advanced Threat Protection is a new service that helps our enterprise customers to detect, investigate, and respond to advanced and targeted attacks on their networks.
News & Resources
Breach detection Investigation & Response
Windows Defender ATP is composed of three parts:
The client-end-point behavioral sensor, built into Windows 10 (Windows 10 anniversary update, Windows Insider Preview Build number 14332 and later) and activated upon service enrollment. The client logs relevant security events and behaviors from the endpoint.
Cloud security analytics service – processing data from endpoints in combination with historical data and Microsoft’s wide data repository to detect anomalous behaviors, adversary techniques and similarity to known attacks. The service runs on the Microsoft scalable big data platform, and uses a combination of Indicators of Attacks (IOAs), generic analytics and machine learning rules, as well as Indicators of Compromises (IOCs) collected from past attacks.
Microsoft and community intelligence – our hunters and researchers investigate the data, finding new behavioral patterns and correlating the data with existing knowledge from the security community.
The fuel is human expertise.
This team improves Windows and Windows Defender ATP using IOCs and rules.
Our experts bring deep expertise in:
• OS Security • Exploit techniques and analysis • Malware analysis and reverse engineering • Statistical modeling and analysis
Built into Windows, cloud powered
No additional deployment & Infrastructure. Continuously up to date; lower costs.
Behavioral-based, post-breach detection
Actionable, correlated alerts for known and unknown adversaries. Real-time and historical data.
Rich timeline for investigation
Easily understand scope of breach. Data pivoting across endpoints. Deep files and URLs analysis.
Unique threat intelligence knowledge base
Unparalleled threat optics provides detailed actor profiles. First- and third-party threat intelligence data.