Microsoft Defender Experts Hunting

Powered by threat intelligence, Defender Experts Hunting provides around-the-clock, AI-assisted threat hunting across domains.

Defender Experts Hunting is included in Defender Experts MDR and available as a standalone.

Defender Experts Hunting works across Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, Microsoft Entra ID Protection, Microsoft Defender for Identity, and Microsoft Defender for Cloud.

During threat hunting investigations, our analysts refrain from taking direct actions on customer assets. Instead, they provide detailed information, including a threat summary and hunting queries that show the timeline of events for the identified cyberattack and remediation action recommendations. Defender Experts Notifications provide guidance on how to review and address the novel threat.

Submit questions about specific alerts, threats affecting your organization, and notifications you receive. Ask Defender Experts is not intended to answer inquiries related to custom detections, bugs in your product experience in the Defender portal, or those related to security incident response services.

Learn more about sample questions you can ask Defender Experts.