11.4 Defender Threat Intelligence

Quick Answer: Microsoft Defender Threat Intelligence (Defender TI) is a threat-intel platform that gives MS-102 administrators intelligence on threat actors, infrastructure, tooling, indicators of compromise (IOCs), and curated articles and profiles. Use it to research an indicator from an incident, enrich alerts with adversary context, and hunt for the same indicators across the organization. Defender TI is research and enrichment — the actual detections still come from the Defender XDR engines.

What Defender Threat Intelligence Provides

Defender TI aggregates Microsoft's internal threat-intelligence signals (from Defender XDR, Microsoft's research teams, and acquired intel sources) and exposes them as a searchable research platform. It is accessible both inside the Microsoft Defender portal and via the standalone Defender TI experience. The core content types are:

• Indicators of compromise (IOCs) — IPs, domains, URLs, and file hashes with reputation and associated threat context.
• Threat actor profiles — named groups with targeted industries, regions, targets, observed tooling, and TTPs mapped to MITRE ATT&CK.
• Articles and reports — curated write-ups of campaigns, vulnerabilities, and adversary tradecraft.
• Infrastructure — resolved DNS records, WHOIS, certificates, and hosting relationships that help analysts understand adversary infrastructure and pivot to related infrastructure.
• Tooling — malware families and tools used by threat actors, with their associated IOCs.

Researching an Indicator

A typical Defender TI workflow starts with an indicator pulled from an incident — say, a suspicious destination IP from a Defender for Endpoint network event:

1. Search the IP in Defender TI to pull its reputation, associated articles, and linked infrastructure.
2. Pivot to related infrastructure: domains resolving to that IP, certificates sharing that IP, other IPs in the same hosting block.
3. Profile the threat actor or malware family tied to the indicator — its targets, TTPs, and known tooling.
4. Enrich the original alert with this context so the incident owner understands who is likely behind the activity and why it matters.
5. Hunt across the tenant for the same indicators and related infrastructure using advanced hunting, and add any new findings to the incident.

This pivot-from-incident flow is the most important behavior to understand for the exam, because it is how "review and respond to threats identified by Microsoft Defender Threat Intelligence" is actually operationalized.

Integrating TI With Incident Response

Defender TI is not a standalone research toy — it plugs into the incident workflow:

• Enrichment — when an incident contains an indicator (IP, domain, URL, hash), TI provides context that helps the analyst decide severity and classification. An IP associated with a known ransomware delivery campaign changes the triage priority of an otherwise generic network alert.
• Hunting — take the indicators from the TI article for an emerging threat and run an advanced hunting query across the tenant to see whether the organization has been targeted. This is the manual counterpart to the automatic threat-analytics detections.
• Proactive profiling — review threat actor profiles whose targeting fits the organization's industry and region, then pre-stage detections or hunting queries for their known TTPs.

TI vs. In-Product Detections — the distinction the exam tests

This is the most common point of confusion in Domain 3's threat-intel objective, so get it straight:

A useful framing: Defender TI does not detect anything in your environment by itself. It tells you what an indicator means. The Defender XDR engines detect the activity; TI enriches it so you can respond at the right priority and hunt for related activity.

Threat Actor Profiles and MITRE ATT&CK

Defender TI threat actor profiles map observed behaviors to the MITRE ATT&CK framework, which is the de facto taxonomy of adversary tactics, techniques, and procedures. Each technique in an actor profile (for example, T1566 Phishing for initial access, or T1003 OS credential dumping for credential access) can be used to drive detection engineering and hunting — the same techniques map cleanly to advanced hunting tables and Defender XDR alert categories, which is why MITRE ATT&CK is the common vocabulary across the XDR stack.

A Note on Licensing and Access

Defender Threat Intelligence is licensed separately from the base Defender XDR workloads. For the MS-102 exam, the key facts are that Defender TI exists, that it provides actor/infrastructure/IOC/profile intelligence, that it is reachable from within the Defender portal as well as via a standalone experience, and that the detections themselves come from the Defender XDR engines — not from TI. The exam will test the role of TI in incident response, not the licensing matrix.