Microsoft Defender XDR Deep-To-Dive

Microsoft Defender XDR Deep Dive – Part1

Microsoft Defender XDR is an integrated security platform that processes telemetry from different areas of an enterprise environment—endpoints, identity management, email traffic, SaaS applications, and cloud resources—in a unified way. Its goal is to interpret isolated events as coherent attack patterns and, based on these, execute automated or guided response actions.

Architecture and Components

Defender XDR combines multiple natively integrated security products. These are not standalone modules but operate on a shared data model and unified incident-handling logic.

Microsoft Defender for Endpoint (MDE)

Defender for Endpoint is Microsoft’s endpoint protection and EDR platform, which collects deep system telemetry, performs behavioral detection, and provides automated response capabilities.

• Kernel-level telemetry:
  It collects data from deep within the Windows OS, including:
  • Process creation
  • Module loading
  • Registry modifications
  • Network connections
  • Memory operations
• Behavior-based detection: Instead of relying only on file or hash-based signatures, it identifies attack techniques.
• Automated Investigation and Response (AIR): The system automatically analyzes alerts, performs investigation steps, and triggers recommended or automatic remediation actions.

Microsoft Defender for Identity (MDI)

Defender for Identity analyzes security telemetry from hybrid Active Directory environments and detects techniques commonly used by attackers, such as lateral movement, privilege escalation, and anomalies.

It detects:

• Lateral movement techniques (Kerberoasting, Pass-the-Hash, Pass-the-Ticket)
• Domain reconnaissance (e.g., mass LDAP queries, enumeration of privileged groups)
• Suspicious authentication patterns (unusual login behavior monitoring)

Microsoft Defender for Office 365 (MDO)

Provides protection for email and collaboration environments, with a focus on detecting phishing, Business Email Compromise (BEC), malware, and link-based attacks.

Key capabilities:

• Phishing and BEC detection
• URL and attachment sandboxing via Safe Links and Safe Attachments
• User-reported message integration

Microsoft Defender for Cloud Apps (MDCA)

Defender for Cloud Apps is Microsoft’s CASB solution. It monitors SaaS usage, risks, and identity/data movements associated with cloud applications. It provides visibility, real-time control, and anomaly detection.

Key capabilities:

• Shadow IT discovery: Identifies cloud services used in the organization based on network and endpoint telemetry, and ranks them by risk (data handling, compliance, security posture).
• OAuth apps and third-party integrations risk analysis: Evaluates permissions and behavior of user-authorized applications (e.g., CRMs, automation tools).
• Session control: Via Conditional Access App Control, it can intervene in real time:
  • Block downloads
  • Enforce DLP policies
  • Restrict uploads

Permission Model in Defender XDR

Permission management operates on two layers:

• Entra ID roles (tenant-level access and administration)
• Defender portal roles (SOC-level operations, investigation, response)

They are complementary: Entra ID provides the framework, Defender roles provide granular control.

Entra ID jogosultságok – a hozzáférés alapja

Entra ID Permissions – Foundation of Access

Entra ID roles define whether a user can:

• Access the Defender portal
• Modify global security settings
• Perform tenant-level operations

Key Entra ID roles

Global Administrator

• Full access to everything

Security Administrator

• Access to Defender portal
• Modify security settings
• Initiate response actions (e.g., disable user, revoke tokens)

Security Reader

• Read-only access to Defender XDR
• Cannot perform response actions

Global Reader

• Tenant-wide read-only access

Privileged Role Administrator

• Manages role assignments and permissions

Defender Portal Roles – SOC-Level Access Control

Defender portal roles provide fine-grained operational control:

They define whether a user can:

• View alerts
• Investigate entities
• Run hunting queries
• Isolate devices
• Delete emails
• Execute response actions

Key Defender roles

Security Operations Administrator

• Full SOC admin privileges
• AIR actions
• Device isolation
• Process termination
• User disable, token revoke
• Email purge
• Threat hunting

(SOC Tier 3 role)

Security Operations Analyst

• Alert investigation
• Incident handling
• Approve AIR actions
• Run hunting queries

(SOC Tier 1–2 role)

Security Reader

• Read-only access
• No response actions

Specialized roles

Email & Collaboration Administrator (MDO-specific)

• Email purge
• URL/attachment policies
• Threat Explorer
• User report handling

Device Management / Endpoint Administrator (MDE-specific)

• Device isolation
• EDR policy management
• Onboarding/offboarding
• Antivirus policy control

Cloud App Administrator (MDCA-specific)

• OAuth app blocking
• Session control rules
• Shadow IT configuration
• App governance actions

How Defender XDR Actually Works

Defender XDR is not a collection of separate tools, but a unified security layer that interprets signals from across the Microsoft ecosystem using a shared data model. It is built on three core pillars:

1. Incident-level correlation
2. Automatic Attack Disruption
3. Cross-domain Threat Hunting

1. Incident-Level Correlation – Building Attack Chains

Defender XDR does not show a list of alerts—it constructs unified attack stories.

Telemetry from MDE, MDI, MDO, and MDCA is mapped into a shared entity model, where the system identifies whether:

• the same user
• the same device
• the same mailbox
• the same SaaS application
• the same domain controller

are part of the same attack.

Technical concept

Every event is linked to entities:

• User
• Device
• Mailbox
• App / OAuth token
• Domain Controller

Then it correlates them based on time and behavior.

Why this matters for SOC

Instead of manually correlating:

• LSASS access on endpoint
• Mailbox forwarding rule creation
• SaaS API abuse
• Domain controller NTLM anomalies

The system automatically builds a single incident:

user → device → mailbox → SaaS app → domain controller

This means analysts investigate attack narratives, not isolated alerts.

2. Automatic Attack Disruption – Real-Time Response

Defender XDR can not only detect but also intervene before a SOC analyst responds.

Possible actions:

• Account lockout (Entra ID + Conditional Access enforcement)
• Device network isolation (MDE)
• Token revocation (OAuth / refresh tokens)
• Blocking lateral movement (MDI)
• Killing malicious processes
• Blocking SaaS apps (MDCA)

Decision logic

The system watches attack patterns such as:

• credential theft → suspicious login → mailbox changes → lateral movement
• phishing → OAuth consent → API abuse → data exfiltration
• malware execution → C2 communication → privilege escalation

When patterns exceed a “disruption threshold,” automated action is triggered.

Example scenario

1. Attacker steals credentials via phishing
2. Logs in from unknown IP
3. Attempts multiple RDP connections within 30 seconds
4. MDI detects NTLM anomalies on domain controller
5. MDE detects suspicious network behavior

Response:

• User account is automatically disabled
• Source device is isolated
• Tokens are revoked
• Attack chain is broken

Result: the attack is stopped before privilege escalation or data exfiltration.

3. Threat Hunting (KQL) – Cross-Domain Investigation

Threat hunting allows SOC analysts to query across all domains using KQL:

What can be queried:

• Endpoint telemetry (process trees, network activity, registry, file actions)
• Identity events (Kerberos, NTLM, LDAP, authentication patterns)
• Email activity (sending, receiving, link clicks, attachments)
• SaaS activity (OAuth usage, API calls, session events)

Why it is powerful

SOC analysts can investigate:

• full user activity history
• full device behavior
• complete attack timeline

using a single query, instead of multiple disconnected systems.