Microsoft Defender XDR Updates

Microsoft Defender Experts for Hunting reports

use tasks in the Microsoft Defender portal to break down incident investigations into actionable steps

hunt using the hunting graph, which renders rendering predefined threat scenarios as interactive graphs.

the number of query results displayed in the Microsoft Defender portal has been increased to 100,000.

(Preview) Advanced hunting now lets you investigate Microsoft Defender for Cloud behaviors.

(GA) In advanced hunting, you can now view all your user-defined rules

The GraphApiAuditEvents table in advanced hunting is now available for preview.

(Preview) The DisruptionAndResponseEvents table, now available in advanced hunting

use the adx() operator to query tables stored in Azure Data Explore

(Preview) In advanced hunting, you can now view all your user-defined rules

You can now view the details pane even for analytics rules

(Preview) You can now highlight your security operations achievements

unified security summary

create data security investigations in the Microsoft Defender portal with the integration of Microsoft Purview Data Security

(Preview) Contain IP addresses of undiscovered devices

OnboardingStatus and NetworkAdapterDnsSuffix columns

The OAuthAppInfo table is now available for preview in advanced hunting.

You can now link Threat analytics reports when setting up custom detections

You can now view how Security Copilot came up with the query suggestion in its responses

IP addresses can now be excluded from automated responses in attack disruption

Device activity events from Microsoft Sentinel's device entity pages are now visible

Advanced hunting context panes are now available in custom detection experiences

Defender Boxed is available for a limited time in January and July of each year

Microsoft Defender Experts for XDR now offers scoped coverage

Link to incident feature in Microsoft Defender

(Preview) Attack paths in the incident graph are now available

Microsoft Defender XDR customers can now export incident data to PDF

Microsoft Unified RBAC roles are added with new permission levels

The global search for entities in the Microsoft Defender portal is now generally available