Microsoft Defender Threat Intelligence
Stop Ransomware with Microsoft Security
Uncover your adversaries
Accelerate threat detection and remediation
Enhance your security tools and workflows
Be more efficient
Save up to 60 percent by using Microsoft Security rather than multiple point solutions.1
Capabilities
Uncover and help eliminate threats with Defender Threat Intelligence.
- Get continuous threat intelligence
- Expose adversaries and their methods
- Enhance alert investigations
- Accelerate incident response
- Hunt threats as a team
- Expand prevention and improve security posture
Get continuous threat intelligence
Scan the internet to create a complete picture of day-to-day changes. Create threat intelligence for your own business to understand and reduce exposure.
Expose adversaries and their methods
Understand the group behind an online attack, their methods, and how they typically operate.
Enhance alert investigations
Enrich Microsoft Sentinel and Microsoft 365 Defender incident data with external threat intelligence to uncover the full scale of a threat or attack.
Accelerate incident response
Investigate and remove malicious infrastructure such as domains and IPs and all the known tools and resources operated by an attacker or threat family.
Hunt threats as a team
Easily collaborate on investigations across teams using the Defender Threat Intelligence workbench and share knowledge of threats with Intel Profiles.
Expand prevention and improve security posture
Automatically uncover malicious entities and help stop outside threats by blocking internal resources from accessing dangerous internet resources.
Get continuous threat intelligence
Scan the internet to create a complete picture of day-to-day changes. Create threat intelligence for your own business to understand and reduce exposure.
Expose adversaries and their methods
Understand the group behind an online attack, their methods, and how they typically operate.
Enhance alert investigations
Enrich Microsoft Sentinel and Microsoft 365 Defender incident data with external threat intelligence to uncover the full scale of a threat or attack.
Accelerate incident response
Investigate and remove malicious infrastructure such as domains and IPs and all the known tools and resources operated by an attacker or threat family.
Hunt threats as a team
Easily collaborate on investigations across teams using the Defender Threat Intelligence workbench and share knowledge of threats with Intel Profiles.
Expand prevention and improve security posture
Automatically uncover malicious entities and help stop outside threats by blocking internal resources from accessing dangerous internet resources.
How Microsoft Defender Threat Intelligence works
Microsoft tracks more than 65 trillion signals daily, helping security teams identify vulnerabilities with greater efficacy and stay ahead of today's threats.
Related products
Use best-in-class Microsoft security products to help prevent and detect attacks across your organization.
Microsoft Sentinel
See and stop threats across your entire enterprise with intelligent security analytics.
Microsoft Defender for Cloud
Increase protection in your multicloud and hybrid environments.
Microsoft Defender External Attack Surface Management
Understand your security posture beyond the firewall.
Additional resources
Announcement
Read the threat intelligence blog
Learn about the new threat intelligence offerings from Microsoft.
Infographic
Help protect your business with threat intelligence
Learn how to use internet threat intelligence to defend your organization against attacks.
Documentation
Best practices and implementation
Get started with threat intelligence solutions for your organization today.
Infographic
The scale and scope of cybercrime in 60 seconds
During a cyberattack, every second counts. We’ve condensed a year’s worth of cybersecurity research into one 60-second window.
Protect everything
Microsoft Defender Threat Intelligence is a complete threat intelligence platform. It helps security professionals analyze and act upon signals collected from the internet by a global collection network and processed by security experts and machine learning. These data sets show the infrastructure connections across the global threat landscape, uncovering an organization’s external attack surface and enabling teams to investigate the tools and systems used to attack it. Defender Threat Intelligence provides external context for internal security incidents via SIEM and XDR capabilities in Microsoft Sentinel and Microsoft 365 Defender.