defender-xdr

name	defender-xdr
description	Guidance for Microsoft Defender XDR — the unified extended detection and response suite that correlates signals across endpoints, identities, email, and cloud apps into prioritised incidents with attack-graph context. Covers onboarding the four core workloads, incident investigation, advanced hunting in KQL, custom detection rules, automatic attack disruption, AIR, and unified RBAC. WHEN: Microsoft Defender XDR, XDR incident investigation, correlate alerts across workloads, advanced hunting KQL, automatic attack disruption, AIR, Defender portal incidents, cross-domain detection, how do I investigate an attack across multiple Microsoft 365 products, alert correlation across endpoint and identity, unified incident view, attack graph, custom detection rule, unified RBAC. DO NOT USE when the need is SIEM log ingestion or custom KQL detections from third-party sources (use sentinel), merging Sentinel into the Defender portal (use unified-secops-platform), or endpoint-only EDR (use defender-for-endpoint).
license	MIT
metadata	{"author":"Microsoft","version":"0.1.0"}

Microsoft Defender XDR

Microsoft Defender XDR is a unified pre- and post-breach defence suite. It natively correlates signals across endpoints (MDE), identities (MDI + Entra ID Protection), email/collaboration (MDO), and cloud apps (MDA) to deliver a single prioritised incident with the full attack story - graph, timeline, evidence, and recommended actions.

When to use

Running coordinated detection and response across the Microsoft 365 estate from one portal (security.microsoft.com), instead of investigating each workload in isolation. Also when you need the attack disruption feature - it requires the XDR correlation.

Do not use this skill when ingesting third-party logs or writing custom KQL detections across non-Microsoft sources (sentinel), merging Sentinel + Defender into one portal (unified-secops-platform), or tuning endpoint-only policies (defender-for-endpoint).

Map the signal to the source workload

XDR is only as good as the workloads feeding it. Use this to confirm what's onboarded and which alerts are missing.

If the signal is...	Source workload	Required licence
Process tree, network connection, file hash on a device	Defender for Endpoint (MDE) P2	M365 E5 / MDE P2
Kerberos anomaly, DCSync, AD CS abuse, on-prem lateral movement	Defender for Identity (MDI)	M365 E5 / EMS E5
Risky sign-in, leaked credentials, anomalous token use	Entra ID Protection	Entra ID P2
Phishing URL click, malicious attachment detonation, BEC	Defender for Office 365 P2	M365 E5 / MDO P2
Risky OAuth app, anomalous SaaS upload, MCAS-style alert	Defender for Cloud Apps (MDA)	MDA standalone or E5
Azure resource alert, AKS pod compromise	Defender for Cloud	DfC plan-based

Rule of thumb: if an incident shows "1 alert, 1 entity," a workload is missing. A real attack always touches at least two of the above.

Approach

1. Onboard the core workloads first — In order: MDE (highest endpoint signal), MDI (lateral movement), Entra ID Protection, MDO. Add MDA when SaaS apps are in scope. Each workload onboarded to its own portal still surfaces in the unified Defender portal. Verify: Incidents view shows alerts from at least 3 different ServiceSource values after 24 hours.

2. Configure unified RBAC before broad enablement — Move from per-workload roles to Microsoft Defender XDR Unified RBAC (security.microsoft.com → Permissions). Build custom roles scoped by data source + permission level. Pilot in active-directory mode for 30 days before enforcing. Verify: a Tier-1 analyst can triage and contain but not modify policies; a Tier-3 can tune detections but not change RBAC.

3. Investigate by incident, not by alert — Incidents group related alerts, assets, and evidence with an attack graph. Always start from the Incidents queue. The attack graph shows the kill chain across workloads in one view. Verify: open a multi-alert incident; the graph shows entities (user, device, mailbox, IP) linked across workloads.

4. Enable automatic attack disruption — Defender XDR can contain high-confidence active attacks (disable a user, isolate a device, contain a mailbox) using cross-signal confidence ≥ 99%. Roll out in report-only for 14 days, review actions, then enforce. Verify: review Action center for past 14 days; no false positives in disruption actions.

5. Advanced hunting — Query the shared schema in KQL (DeviceEvents, IdentityLogonEvents, EmailEvents, CloudAppEvents). Promote useful hunts into custom detection rules with incident grouping and impacted entities mapped. Verify: each custom rule has entity mappings; without them, alerts don't join into incidents.

6. Automated Investigation & Remediation (AIR) — Configure remediation level per device group (No remediation → Semi → Full). Most environments run Full on workstations, Semi on servers.

7. Coverage review monthly — Use the MITRE ATT&CK coverage view to find blind spots. Track median time-to-acknowledge and time-to-contain as the only two SOC metrics that matter for XDR ROI.

Guardrails

• All four workloads or you don't have XDR. A "Defender XDR with only MDE" deployment is EDR with a fancy portal. The correlation needs at least MDE + MDI + Entra ID Protection.
• Unified RBAC first, then enable broadly. Without it, analysts get tenant-wide rights via per-workload role groups. Lock down RBAC before granting access.
• Run attack disruption in report-only first. It will isolate devices and disable users. Pilot the actions for 14 days, review the Action Center, then enforce.
• Custom detection rules need entity mappings. Without them, alerts don't correlate into incidents and the attack graph is broken.
• Don't suppress incidents at the queue level. Suppress at the alert source (MDE/MDI/MDO) so the underlying detection still tunes. Queue suppression hides the symptom, not the cause.
• The Defender portal is the SOC pane. Don't have analysts swivel between MDE, MDI, MDO portals - that's the problem XDR exists to solve.

Common anti-patterns

• "We onboarded MDE only and call it XDR" - Half the kill chain is invisible. Onboard MDI and Entra ID Protection before claiming XDR coverage.
• "Each Defender workload has its own analyst team" - Defeats the unified investigation model. One incident, one analyst, all workloads.
• "Enabled attack disruption tenant-wide on day one" - Will disrupt legitimate activity (e.g. a pen test that looks like ransomware). Report-only 14 days first.
• "Custom rules without entity mappings" - Alerts don't aggregate into incidents. Always map at least one entity (user/device/IP).
• "Use unified RBAC for some workloads and legacy RBAC for others" - Permission overlap creates over-privilege. Migrate all workloads or none.
• "AIR set to No remediation everywhere because we don't trust automation" - Analyst hours wasted on rote tasks. Start Semi on workstations and review.

Example prompts

• What are the first Defender XDR controls I should enable for a new Microsoft 365 tenant?
• Walk me through how to investigate a multi-stage incident in Defender XDR using the attack graph.
• Write an advanced hunting KQL query to find suspicious PowerShell execution across devices.
• How does automatic attack disruption work and what should I configure first?
• How do I correlate an identity alert with a device alert in the same incident?
• Design the unified RBAC roles for a 3-tier SOC.
• Convert this hunting query into a custom detection rule with entity mappings.

Microsoft Learn

• Overview: https://learn.microsoft.com/defender-xdr/microsoft-365-defender
• Advanced hunting: https://learn.microsoft.com/defender-xdr/advanced-hunting-overview
• Attack disruption: https://learn.microsoft.com/defender-xdr/automatic-attack-disruption
• Custom detection rules: https://learn.microsoft.com/defender-xdr/custom-detection-rules
• Unified RBAC: https://learn.microsoft.com/defender-xdr/manage-rbac
• Incident investigation: https://learn.microsoft.com/defender-xdr/investigate-incidents
• AIR overview: https://learn.microsoft.com/defender-xdr/m365d-autoir