Microsoft Defender Threat Intelligence
Stop Ransomware with Microsoft Security
Uncover your adversaries
Accelerate detection and remediation
Enhance your security tools and workflows
Be more efficient
Save up to 60 percent by using Microsoft Security rather than multiple point solutions.1
Capabilities
Uncover and help eliminate threats with Defender Threat Intelligence.
- Get continuous threat intelligence
- Expose adversaries and their methods
- Enhance alert investigations
- Accelerate incident response
- Hunt threats as a team
- Expand prevention and improve security posture
Get continuous threat intelligence
Scan the internet to create a complete picture of day-to-day changes. Create threat intelligence for your own business to understand and reduce exposure.
Expose adversaries and their methods
Understand the group behind an online attack, their methods, and how they typically operate.
Enhance alert investigations
Combine Microsoft Sentinel and Microsoft 365 Defender incident data with external threat intelligence to uncover the full scale of a threat or attack.
Accelerate incident response
Investigate and remove a single malicious IP or domain and all the known entities and resources operated by an attacker or threat family.
Hunt threats as a team
Easily collaborate on investigations across global teams using the Defender Threat Intelligence workbench. Share insights across the organization.
Expand prevention and improve security posture
Export lists of malicious entities, IPs, and domains. Block internal resources from accessing dangerous internet resources and help stop outside threats.
Get continuous threat intelligence
Scan the internet to create a complete picture of day-to-day changes. Create threat intelligence for your own business to understand and reduce exposure.
Expose adversaries and their methods
Understand the group behind an online attack, their methods, and how they typically operate.
Enhance alert investigations
Combine Microsoft Sentinel and Microsoft 365 Defender incident data with external threat intelligence to uncover the full scale of a threat or attack.
Accelerate incident response
Investigate and remove a single malicious IP or domain and all the known entities and resources operated by an attacker or threat family.
Hunt threats as a team
Easily collaborate on investigations across global teams using the Defender Threat Intelligence workbench. Share insights across the organization.
Expand prevention and improve security posture
Export lists of malicious entities, IPs, and domains. Block internal resources from accessing dangerous internet resources and help stop outside threats.
How Microsoft Defender Threat Intelligence works
Microsoft tracks over 24 trillion signals daily, helping security teams identify vulnerabilities with greater efficacy and stay ahead of today's threats.
Related products
Use best-in-class Microsoft security products to help prevent and detect attacks across your organization.
Microsoft Sentinel
See and stop threats across your entire enterprise with intelligent security analytics.
Microsoft Defender for Cloud
Increase protection in your multicloud and hybrid environments.
Microsoft Defender External Attack Surface Management
Understand your security posture beyond the firewall.
Additional resources
Announcement
Read the threat intelligence blog
Learn about the new threat intelligence offerings from Microsoft.
Infographic
Help protect your business with threat intelligence
Learn how to use internet threat intelligence to defend your organization against attacks.
Documentation
Best practices and implementation
Get started with threat intelligence solutions for your organization today.
Infographic
The scale and scope of cybercrime in 60 seconds
During a cyberattack, every second counts. We’ve condensed a year’s worth of cybersecurity research into one 60-second window.
Protect everything
Microsoft Defender Threat Intelligence is a complete threat intelligence platform. It helps security professionals analyze and act upon signals collected from the internet by a global collection network and processed by security experts and machine learning. These data sets show the infrastructure connections across the global threat landscape, uncovering an organization’s external attack surface and enabling teams to investigate the tools and systems used to attack it. Defender Threat Intelligence provides external context for internal security incidents via SIEM and XDR capabilities in Microsoft Sentinel and Microsoft 365 Defender.