Microsoft Defender Threat Intelligence

Unmask and neutralize modern adversaries and cyberthreats such as ransomware.

👁 People working in office

👁 Image

OVERVIEW

Uncover your adversaries

Expose and eliminate modern cyberthreats and their infrastructure using dynamic threat intelligence.

Understand your adversaries and their online infrastructures to identify your potential cyberthreat exposures using a complete map of the internet.

👁 A person looking at a laptop.
Discover the full scope of a cyberattack. Understand an online adversary’s entire toolkit, prevent access by all their machines and known entities, and continuously block IP addresses or domains.

👁 A person using a laptop.
Extend the reach and visibility of your existing security investments. Gain more context and understanding of cyberthreats with Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Security Copilot.

👁 A man wearing glasses looks at a computer screen.

How it works

How to use Microsoft Defender Threat Intelligence

Microsoft tracks more than 78 trillion signals daily, helping security teams identify vulnerabilities with greater efficacy and stay ahead of today's cyberthreats.

👁 Infographic of Microsoft Defender XDR using telemetry and data sets to deliver threat intelligence and Copilot.

Capabilities

Uncover and help eliminate cyberthreats with Defender Threat Intelligence.

Get continuous threat intelligence

Expose adversaries and their methods

Accelerate incident response

Hunt cyberthreats as a team

Expand prevention and improve security posture

File and URL (detonation) intelligence

Get a complete view of the internet and track day-to-day changes. Create threat intelligence for your own business to understand and reduce exposure.

👁 Microsoft Defender Threat Intelligence page showing Aqua Blizzard indicators list with domains and SHA-256 hashes.

Understand the group behind an online attack, their methods, and how they typically operate.

👁 Microsoft Defender profile for Diamond Sleet threat actor with description, targeting details, and origin North Korea.

Investigate and remove malicious infrastructure such as domains and IPs and all the known tools and resources operated by a cyberattacker or cyberthreat family.

👁 MS Defender Intel Explorer shows IP 185.82.217.3 as malicious, score 100, linked to threat actor Silk Typhoon.

Easily collaborate on investigations across teams using the Defender Threat Intelligence workbench and share knowledge of cyberthreat actors, tooling, and infrastructure with projects and intelligence profiles.

👁 Microsoft Defender Intel Profiles page listing threat actors, countries of origin, targets, and indicator counts.

Automatically uncover malicious entities and help stop outside cyberthreats by blocking internal resources from accessing dangerous internet resources.

👁 Microsoft Defender page showing telgaram.ru marked malicious, with a table of resolved IPs, ASN details, and last-seen dates.

Submit a file or URL to know its reputation quickly. Enrich security incidents with in-context threat intelligence.

👁 Microsoft Defender dashboard showing threat analysis, intel profiles, articles, certificates, and a highlighted phishing article.