Bringing Defender Experts protection and proactive hunting into focus
As threats move faster and security environments grow more complex, security teams need to quickly understand what matters, where potential risks may exist, and when action is needed. The value of Defender Experts MDR, which includes Defender Experts Hunting, extends beyond the incidents customers see. Across managed detection and response and managed threat hunting, Microsoft experts proactively investigate suspicious activity and emerging threats, helping provide earlier awareness of potential risk and greater confidence when investigations find no hidden activity. Now, new Defender Experts experiences in the Defender portal bring that ongoing work into focus. Customers can more easily discover Defender Experts MDR and Defender Experts Hunting, understand what experts are investigating and what they found, identify what requires attention, and know when action is needed. We’re introducing a more cohesive Defender Experts experience, including a dedicated homepage entry point, persistent left-navigation access, consolidated overview experiences, and a new Hunts experience with visibility into in-progress and completed hunts. Together, these experiences create a clearer, purpose-built home for customers to see expert activity, understand outcomes, and move from insight to action. Discover Defender Experts in your existing security workflows Defender Experts is now easier to discover and access within the Microsoft Defender portal. A dedicated card on the homepage provides visibility into the service as customers begin their security workflow, while a persistent Defender Experts section in the left navigation provides a consistent way to access the experience from across the portal. These entry points help make Defender Experts a more connected part of customers’ existing security operations workflows. Teams can move from a broader view of their security environment into the expert activity, investigations, findings, and actions relevant to them without losing context. Together, the homepage and navigation establish a consistent starting point for Defender Experts, making it easier for customers to discover the service, return to expert-led work, and move into the details that require their attention. Understand what matters and where attention is needed most The Defender Experts overview page brings service activity, outcomes, and next steps together in one connected view, helping customers quickly understand what Defender Experts is doing on their behalf and where their attention may be required. For Defender Experts MDR customers, the overview brings together managed responses and messages, operational service status, reports, and recent hunting outcomes. Customers can identify where attention may be needed and move directly to the supporting details. Defender Experts for Hunting customers receive an overview built on the same foundation and tailored to proactive managed hunting, providing visibility into expert-led investigations and hunting outcomes. This visibility is valuable even during periods with low incident volume. The absence of incidents does not mean an absence of expert activity. Customers can see the continuity of proactive hunting work and better understand how Defender Experts continues to investigate potential threats on their behalf, ensuring protection against threats. See proactive protection in action with the Hunts experience We’re also introducing a new Hunts experience that gives Defender Experts customers a centralized view of the hunts Microsoft experts are conducting in their environment. Customers can see investigations while they are in progress and return after a hunt is complete to review the outcome and supporting details. This creates a more continuous view of proactive hunting, from the questions experts are investigating to the conclusions they reach. When a noteworthy threat is circulating, customers can see that Defender Experts is investigating it on their behalf. The status-aware experience distinguishes work in progress from final conclusions, helping customers understand whether experts are still investigating, what they ultimately found, and whether follow-up action is required. The Hunts experience includes both intelligence-based and suspicious activity hunts. Intelligence-based hunts proactively investigate emerging threats, attacker techniques, campaigns, and other intelligence-driven hypotheses. Suspicious activity hunts begin when Defender Experts identifies behavior in a customer environment that warrants deeper investigation. Importantly, a hunt does not need to uncover a threat to provide value. Completed hunts create a durable record of proactive hunting activity, including investigations that do not result in an incident, giving customers greater visibility into the work performed on their behalf. From expert activity to action Together, these experiences create a more connected Defender Experts journey. The homepage and persistent navigation make Defender Experts easier to discover. The overview helps customers understand service activity, outcomes, and where attention may be needed. And the Hunts experience provides greater transparency into proactive investigations, from work underway to completed findings. For Defender Experts MDR customers, these experiences bring managed detection and response and proactive hunting into a more cohesive portal experience. For Defender Experts for Hunting customers, they give proactive hunting a dedicated experience that reflects how the service delivers ongoing value. Most importantly, the new experiences help security teams answer practical questions more quickly: What are Microsoft experts investigating? What did they find? What matters to my organization? And does my team need to act? As more Defender Experts capabilities and security insights come into the Microsoft Defender portal, this experience provides a foundation for customers to discover them, understand how they relate to their service, and move from insight to action. Get started Eligible Defender Experts customers can access these experiences in the Microsoft Defender portal, subject to their service entitlement and portal permissions. To learn more about Defender Experts MDR, visit the webpage and product documentation. You can also join the Microsoft Defender Experts community on Microsoft Tech Community to ask questions, participate in discussions, and share feedback.
