What’s New at Ignite: Powerful Enhancements in Unified Threat Intelligence
At Microsoft Ignite 2025, we’re unveiling transformative upgrades in threat intelligence designed to empower security teams. With the Threat Intelligence Briefing Agent now fully integrated into the Defender portal, defenders can shift from reactive to proactive security strategies, using Microsoft’s global intelligence combined with insights tailored to their organization. Additionally, the latest phase of the integration of Microsoft Defender Threat Intelligence (MDTI) with Defender XDR and Sentinel brings together unified, real-time threat intelligence and advanced analytics, streamlining the SecOps experience and equipping organizations with powerful tools to anticipate and address emerging threats more effectively. Threat Intelligence Briefing Agent in Defender Launched in March, the Threat Intelligence Briefing Agent has already enabled security teams to shift from reactive defense to proactive threat anticipation. At Ignite, we’re excited to announce that this agent is now fully integrated into the Microsoft Defender portal, currently available in Public Preview. It delivers daily, customized briefings, combining Microsoft’s global threat intelligence with insights specific to each organization, in just minutes. Instead of spending hours piecing together information from multiple sources, analysts now receive automated, up-to-date intelligence summaries. These briefings help analysts quickly prioritize actions by providing risk assessments, clear recommendations, and direct links to vulnerable assets, empowering organizations to address exposures proactively. MDTI Convergence into the Defender Portal In July, we announced the integration of Microsoft Defender Threat Intelligence (MDTI) directly into Defender XDR and Microsoft Sentinel. This integration delivers world-class, real-time threat intelligence within a unified SecOps experience, all at no additional cost. We are pleased to share that the first phase of this convergence is now available in Public Preview. It features Microsoft’s comprehensive threat intelligence library within Threat Analytics, and new enhancements making it easier than ever for users to access, understand, and act on this critical information. Threat Intelligence Library in the Defender Portal Defender XDR customers will have access to Microsoft’s comprehensive threat intelligence library via threat reports within threat analytics (TA). This includes exclusive analyses of threat activity and the detailed content focused on threat actors, threat tooling, and vulnerabilities found in intel profiles. Threat reports are automatically correlated with related incidents and affected assets, revealing endpoint vulnerabilities and recommended actions. Threat analytics in Defender enables and empowers customers to get threat insights around emerging threats on a global scale . Threat analytics provides contextual and operational information about the relevance of each threat for an organization, which allows security teams to organize and prioritize their operations and triage processes based on impact, available as in-product reports. Threat reports published in Threat analytics include threat activity such as: Active threat actors and their campaigns Popular and new attack techniques Critical vulnerabilities Common attack surfaces Prevalent malware Threat reports provide analysts with insights into the methods and attack patterns employed by threat actors, along with details on vulnerabilities, zero-day exploits, and potentially harmful tools. These findings are correlated with relevant contextual information from the customer's environment to assess the specific impact each threat may have on their organization. Threat Analytics library now also available to Sentinel-only customers Sentinel-only customers now have access to Microsoft’s threat intelligence library through reports in Threat Analytics (TA), currently in Public Preview. This upgrade, now in Public Preview, brings Microsoft’s world-class threat intelligence and actionable indicators to Sentinel without a Defender XDR license. While incident correlation and automated response remain exclusive to Defender XDR, standalone Sentinel deployments gain improved threat visibility and integrated security options. What’s new in Threat Analytics Threat reports within Threat Analytics have been upgraded with enhanced insights—previously accessible exclusively through an MDTI license—to provide Defender customers with improved context regarding finished intelligence on prevalent threats. The following contextual insights for each report are now available within Threat Analytics: Indicators of Compromise: Each threat report now includes a comprehensive list of indicators attributed to the specific threat. This feature allows customers to review all relevant indicators and access detailed entity information within Defender directly from the report, streamlining navigation to support efficient investigation and triage. MITRE ATT&CK Mapping: By mapping threats’ tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework, customers can proactively identify, detect, and mitigate persistent techniques, ultimately enhancing overall security posture. Targeted Industries & Actor Origin: Reports provide insight into targeted industries and threat actor origins, enabling analysts to prioritize intelligence and contextualize motivations and observed TTPs. Related Intelligence & Aliases: Threat Analytics offers links to related intelligence and presents actor or tool aliases, allowing customers to cross-reference reports and understand the alignment between Microsoft Threat Intelligence and broader industry developments. All these additional insights are available in the overview of a threat report Furthermore, finding threat reports is now easier. The reports are systematically organized and can be filtered by Actor, Tool, Technique, Vulnerability, Activity, or Core threat, making it quicker to locate specific reports. Read more about threat analytics report and the information available here. Access to Indicators of Compromise Indicators of Compromise linked to specific threats provide SOC Analysts with valuable insight into the most common risks faced by their organization. For Defender customers, threat analytics now makes it easier to filter this data according to particular threats. Because information about indicators is vital, unauthorized access poses a risk of data theft or exploitation by malicious actors. Recognising its sensitivity, access to Indicators is restricted to verified customers only. Customers who do not have access to indicators will see the following when attempting to access it: In scenarios where access is restricted, customers will have the option to verify themselves by submitting business information to get access on successful verification. Read more about access to indicators. Customers with access to indicators (with or without the need to submit additional verification) will be able to see the entire list. The improvements to Threat analytics described above are designed to deliver a unified threat intelligence experience. By integrating MDTI features into Microsoft Defender and Sentinel, customers will progressively have access to more valuable insights that were previously available only with paid MDTI licenses. Read more about MDTI convergence here. Link Cases to IOCs for Complete Threat Context You can now link a case directly to relevant Indicators of Compromise (IOCs), ensuring investigations and response workflows stay connected. This feature improves visibility and collaboration, enabling faster, more informed decisions during threat investigations. Conclusion The integration of the Threat Intelligence Briefing agent into the Defender Portal and the convergence of MDTI into Microsoft Defender and Sentinel represents a major leap forward for security teams, delivering unified threat intelligence and streamlined workflows. With enhanced access to threat reports, indicators of compromise, and contextual insights, organizations are better equipped to proactively defend against emerging threats and respond with greater speed and confidence. These advancements ensure that valuable intelligence is accessible to all, strengthening security operations and empowering defenders to stay ahead in an ever-evolving threat landscape.How MDTI Helps Power Copilot for Security
This blog post will delve into Copilot for Security, focusing on the strategic utilization of Microsoft Defender Threat Intelligence (MDTI), a comprehensive threat intelligence product designed to enhance triage, incident response, threat hunting, vulnerability management, and cyber threat intelligence analyst workflows. It will explore how this integral part of Copilot can be effectively harnessed to facilitate comprehensive understanding, investigation, and maneuvering through threat intelligence.What's New: APIs in Microsoft Graph
Unified APIs part of the Microsoft Graph with a single endpoint, permissions, auth model, and access token are now available. We’re happy to share that the new Microsoft Defender Threat Intelligence APIs in MS Graph: Incidents, Alerts, and Hunting are now in public preview!Introducing the MDTI Premium Data Connector for Sentinel
The MDTI and Unified Security Operations Platform teams are excited to introduce an MDTI Premium data connector available in the Unified Security Operations Platform and standalone Sentinel experiences. This connector enables customers to apply the powerful raw and finished threat intelligence in MDTI, including high-fidelity indicators of compromise (IoCs), across their security operations to detect and respond to the latest threats.Introducing the MDTI Home Page Widget and Article Digest
The MDTI team is excited to introduce the MDTI Article Digest, a new way for customers to stay up to speed with the latest analysis of threat activity observed across more than 78 trillion daily threat signals from Microsoft's interdisciplinary teams of experts worldwide.More Threat Intelligence Content In MDTI, TA Enables Better Security Outcomes
Microsoft threat intelligence empowers our customers to keep up with the global threat landscape and understand the threats and vulnerabilities most relevant to their organization. We are excited to announce that we have recently accelerated the speed and scale at which we publish threat intelligence, giving our customers more critical security insights, data, and guidance than ever before.New at Secure: Corpus of Intel Profiles Available in Defender XDR
The Microsoft Defender Threat Intelligence (MDTI) team is excited to announce that we are revealing previews for each of our 350+ intel profiles to all Defender XDR customers for the first time. This represents Microsoft’s broadest expansion of threat intelligence content to non-MDTI customers yet, adding nearly 340 intel profiles to Defender XDR customers' view, including over 200 tracked threat actors, tools, and vulnerabilities that Microsoft has not named anywhere else.What's New at Microsoft Ignite 2023
The Microsoft Defender Threat Intelligence team (MDTI) continuously introduces innovations that make its strategic, tactical, and operational threat intelligence - built from 65 trillion signals and over 10,000 multidisciplinary experts - more accessible to access, ingest, and act upon. Today, we are excited to announce several new features that enhance Microsoft's comprehensive security offering and AI-powered security with crucial context around threat actors, vulnerabilities, and the tools and systems they use to attack and exploit organizations.
