| name | defender-xdr |
| description | Guidance for Microsoft Defender XDR — the unified extended detection and response suite that correlates signals across endpoints, identities, email, and cloud apps into prioritised incidents with attack-graph context. Covers onboarding the four core workloads, incident investigation, advanced hunting in KQL, custom detection rules, automatic attack disruption, AIR, and unified RBAC. WHEN: Microsoft Defender XDR, XDR incident investigation, correlate alerts across workloads, advanced hunting KQL, automatic attack disruption, AIR, Defender portal incidents, cross-domain detection, how do I investigate an attack across multiple Microsoft 365 products, alert correlation across endpoint and identity, unified incident view, attack graph, custom detection rule, unified RBAC. DO NOT USE when the need is SIEM log ingestion or custom KQL detections from third-party sources (use sentinel), merging Sentinel into the Defender portal (use unified-secops-platform), or endpoint-only EDR (use defender-for-endpoint). |
| license | MIT |
| metadata | {"author":"Microsoft","version":"0.1.0"} |
Microsoft Defender XDR
Microsoft Defender XDR is a unified pre- and post-breach defence suite. It natively correlates
signals across endpoints (MDE), identities (MDI + Entra ID Protection), email/collaboration
(MDO), and cloud apps (MDA) to deliver a single prioritised incident with the full attack
story - graph, timeline, evidence, and recommended actions.
When to use
Running coordinated detection and response across the Microsoft 365 estate from one portal
(security.microsoft.com), instead of investigating each workload in isolation. Also when you
need the attack disruption feature - it requires the XDR correlation.
Do not use this skill when ingesting third-party logs or writing custom KQL detections
across non-Microsoft sources (sentinel), merging Sentinel + Defender into one portal
(unified-secops-platform), or tuning endpoint-only policies (defender-for-endpoint).
Map the signal to the source workload
XDR is only as good as the workloads feeding it. Use this to confirm what's onboarded and
which alerts are missing.
| If the signal is... | Source workload | Required licence |
|---|
| Process tree, network connection, file hash on a device | Defender for Endpoint (MDE) P2 | M365 E5 / MDE P2 |
| Kerberos anomaly, DCSync, AD CS abuse, on-prem lateral movement | Defender for Identity (MDI) | M365 E5 / EMS E5 |
| Risky sign-in, leaked credentials, anomalous token use | Entra ID Protection | Entra ID P2 |
| Phishing URL click, malicious attachment detonation, BEC | Defender for Office 365 P2 | M365 E5 / MDO P2 |
| Risky OAuth app, anomalous SaaS upload, MCAS-style alert | Defender for Cloud Apps (MDA) | MDA standalone or E5 |
| Azure resource alert, AKS pod compromise | Defender for Cloud | DfC plan-based |
Rule of thumb: if an incident shows "1 alert, 1 entity," a workload is missing. A real
attack always touches at least two of the above.
Approach
-
Onboard the core workloads first — In order: MDE (highest endpoint signal), MDI (lateral
movement), Entra ID Protection, MDO. Add MDA when SaaS apps are in scope. Each workload
onboarded to its own portal still surfaces in the unified Defender portal.
Verify: Incidents view shows alerts from at least 3 different ServiceSource values
after 24 hours.
-
Configure unified RBAC before broad enablement — Move from per-workload roles to
Microsoft Defender XDR Unified RBAC (security.microsoft.com → Permissions). Build
custom roles scoped by data source + permission level. Pilot in active-directory mode for
30 days before enforcing.
Verify: a Tier-1 analyst can triage and contain but not modify policies; a Tier-3 can
tune detections but not change RBAC.
-
Investigate by incident, not by alert — Incidents group related alerts, assets, and
evidence with an attack graph. Always start from the Incidents queue. The attack graph
shows the kill chain across workloads in one view.
Verify: open a multi-alert incident; the graph shows entities (user, device, mailbox,
IP) linked across workloads.
-
Enable automatic attack disruption — Defender XDR can contain high-confidence active
attacks (disable a user, isolate a device, contain a mailbox) using cross-signal
confidence ≥ 99%. Roll out in report-only for 14 days, review actions, then enforce.
Verify: review Action center for past 14 days; no false positives in disruption actions.
-
Advanced hunting — Query the shared schema in KQL (DeviceEvents, IdentityLogonEvents,
EmailEvents, CloudAppEvents). Promote useful hunts into custom detection rules with
incident grouping and impacted entities mapped.
Verify: each custom rule has entity mappings; without them, alerts don't join into
incidents.
-
Automated Investigation & Remediation (AIR) — Configure remediation level per device
group (No remediation → Semi → Full). Most environments run Full on workstations,
Semi on servers.
-
Coverage review monthly — Use the MITRE ATT&CK coverage view to find blind spots.
Track median time-to-acknowledge and time-to-contain as the only two SOC metrics that
matter for XDR ROI.
Guardrails
- All four workloads or you don't have XDR. A "Defender XDR with only MDE" deployment is
EDR with a fancy portal. The correlation needs at least MDE + MDI + Entra ID Protection.
- Unified RBAC first, then enable broadly. Without it, analysts get tenant-wide rights
via per-workload role groups. Lock down RBAC before granting access.
- Run attack disruption in report-only first. It will isolate devices and disable users.
Pilot the actions for 14 days, review the Action Center, then enforce.
- Custom detection rules need entity mappings. Without them, alerts don't correlate into
incidents and the attack graph is broken.
- Don't suppress incidents at the queue level. Suppress at the alert source (MDE/MDI/MDO)
so the underlying detection still tunes. Queue suppression hides the symptom, not the cause.
- The Defender portal is the SOC pane. Don't have analysts swivel between MDE, MDI, MDO
portals - that's the problem XDR exists to solve.
Common anti-patterns
- "We onboarded MDE only and call it XDR" - Half the kill chain is invisible. Onboard MDI
and Entra ID Protection before claiming XDR coverage.
- "Each Defender workload has its own analyst team" - Defeats the unified investigation
model. One incident, one analyst, all workloads.
- "Enabled attack disruption tenant-wide on day one" - Will disrupt legitimate activity
(e.g. a pen test that looks like ransomware). Report-only 14 days first.
- "Custom rules without entity mappings" - Alerts don't aggregate into incidents. Always
map at least one entity (user/device/IP).
- "Use unified RBAC for some workloads and legacy RBAC for others" - Permission overlap
creates over-privilege. Migrate all workloads or none.
- "AIR set to No remediation everywhere because we don't trust automation" - Analyst hours
wasted on rote tasks. Start Semi on workstations and review.
Example prompts
What are the first Defender XDR controls I should enable for a new Microsoft 365 tenant?Walk me through how to investigate a multi-stage incident in Defender XDR using the attack graph.Write an advanced hunting KQL query to find suspicious PowerShell execution across devices.How does automatic attack disruption work and what should I configure first?How do I correlate an identity alert with a device alert in the same incident?Design the unified RBAC roles for a 3-tier SOC.Convert this hunting query into a custom detection rule with entity mappings.
Microsoft Learn
