Microsoft Defender Experts for XDR

Microsoft Defender Experts for Hunting provides proactive threat hunting service to find threats. This service is meant for customers who have a robust security operations center (SOC) and want that deep expertise in hunting to expose advanced threats. Microsoft Defender Experts for XDR provides end-to-end security operations capabilities to monitor, investigate, and respond to security alerts. This service is meant for customers with constrained SOCs that are overburdened with alert volume, in need of skilled experts, or both. Defender Experts for XDR also includes the proactive threat hunting offered by Defender Experts for Hunting.

Defender Experts for XDR provides managed detection and response across any combination of the following Microsoft Defender products:

• Defender for Endpoint
• Defender for Office 365 P2
• Defender for Identity
• Defender for Cloud Apps
• Microsoft Entra ID P2
• Microsoft Defender for Cloud (with Defender Experts for Servers)

Refer to documentation for more details.

Microsoft expert analysts can take actions based on the roles granted to them in Microsoft Defender. These analysts can investigate and provide managed response for your SOC team to act on. They can also take specific remediation actions agreed upon with your SOC team.

Defender Experts for XDR covers incidents categorized as High or Medium severity in Windows, Linux, and macOS devices. Incidents categorized as Compliance, Data Loss Prevention (DLP), or Custom Detections and those affecting internet of things (IoT), iOS, or Android devices are outside the service's scope.