4.1.3. Threat Analytics

💡 First Principle: Hunting is only as good as its hypotheses, and the best hypotheses come from what real attackers are doing right now. Threat analytics delivers Microsoft's threat research as reports, then joins each report to your telemetry, showing whether the threat has touched your organization and how exposed you are, so you know which hunts to run first.

Threat analytics (in the Defender portal navigation) publishes reports on threat actors, campaigns, attack techniques, vulnerabilities, and prevalent malware, alongside open-source intelligence articles. The dashboard highlights latest threats, high-impact threats (most active and resolved alerts in your environment), and highest exposure threats (most vulnerable devices). Reports can be filtered by threat tags such as ransomware, phishing, vulnerability, and activity group.

Each report has the same structure, and knowing which tab answers which question is testable:

• Overview: summary, MITRE techniques, and charts of related incidents and alerts, impacted assets, and resilience.
• Analyst report: the expert write-up, including the attack chain mapped to ATT&CK, mitigations, detection details, and advanced hunting queries you can run directly.
• Related incidents: incidents in your tenant linked to the threat.
• Impacted assets: your devices, users, mailboxes, apps, and cloud resources with active or resolved alerts tied to the threat.
• Endpoints exposure: your exposure level based on unpatched vulnerabilities and misconfigurations the threat exploits.
• Recommended actions: mitigations tracked in Secure Score, with your current status.
• Indicators: indicators of compromise for hunting and blocking.

Use it as a hunting launch pad: read the analyst report for the technique, run its provided queries, check impacted assets and exposure, then deploy the recommended mitigations. You can link a custom detection rule to a threat analytics report so incidents from that rule appear in the report's related incidents. Email notifications for new or updated reports are configured in Defender XDR email notification settings (2.4.1). Access requires at least one Defender product license and roles such as security data basics read (with vulnerability management read to see exposure data).

⚠️ Exam Trap: "Determine which of your devices are vulnerable to the exploit described in a new threat report" is the report's Endpoints exposure tab (or Impacted assets for devices already alerting), not the Analyst report, which describes the threat in general.

Reflection Question: A threat analytics report shows high exposure but zero related incidents. What does that combination mean, and what two actions should follow?