Microsoft Defender XDR

by Microsoft Corporation

AI Application

Low Confidence

Microsoft Defender XDR is Microsoft's cloud suite for detecting and responding to attacks across endpoints, identities, email and cloud apps (Defender for Endpoint, for Office 365, for Identity, for Cloud Apps and related services), run by IT and security teams or their managed security provider from the Microsoft Defender portal, where Microsoft Sentinel can also run. The vendor says it correlates signals into incidents, and that automatic attack disruption uses graph models, boosted decision trees, neural networks and small language models to identify attacker-controlled assets and then, without waiting for a person, contains or isolates devices, disables or suspends user accounts and revokes sessions, at a stated confidence of 99% or higher. Automated investigation can quarantine files or stop services automatically or after approval, depending on the automation level. Security teams can undo every automatic action and exclude critical assets. Data is stored in Azure in the tenant's region (EU: North and West Europe) and kept for 180 days.