Security
Microsoft Defender for Endpoint
An enterprise endpoint security platform that helps organizations prevent, detect, investigate, and respond to advanced threats across supported devices.
Product
Microsoft Defender for EndpointMicrosoft Defender for Endpoint is an enterprise endpoint security platform protecting laptops, desktops, servers, mobile devices, and other supported endpoints. It combines preventative protection, endpoint detection and response, behavioral analytics, threat intelligence, and automated investigation and response. It also contributes endpoint signals to Microsoft Defender XDR, so teams can correlate device activity with identity, email, application, and cloud evidence.
How it works
- Devices are onboarded to provide hardware, software, configuration, and security telemetry.
- Antivirus, web protection, network protection, device control, and attack surface reduction rules help prevent malicious activity.
- Endpoint sensors and cloud analytics identify malware, suspicious processes, credential theft, persistence, and attacker behavior.
- Alerts include device timelines, process trees, affected files, users, network connections, and threat intelligence.
- Analysts and automated investigations can isolate devices, quarantine files, stop processes, and initiate remediation.
- Endpoint evidence is correlated with other security signals through Microsoft Defender XDR.
A problem it solves
An employee opens a malicious attachment that launches a script, steals browser credentials, and attempts to connect to an attacker-controlled server. Microsoft Defender for Endpoint detects the suspicious process chain and network behavior, alerts the security team, and provides the device timeline needed for investigation. The affected device can be isolated while the malicious file is quarantined.