4.4.7. Microsoft Defender Threat Intelligence

💡 First Principle: Defender Threat Intelligence (Defender TI) aggregates external data about attacker infrastructure, tactics, and indicators of compromise (IOCs) — malicious IP addresses, domains, file hashes — giving analysts outside context about who might be behind an attack and what else that attacker's infrastructure has been used for, beyond what's visible inside your own environment alone.

This external context helps analysts move from "we detected a suspicious connection to this IP" to "this IP is known infrastructure associated with a specific tracked threat actor known for targeting this industry" — informing both the urgency of the response and what else to watch for.

⚠️ Exam Trap: Defender TI provides external threat context (who's attacking, what infrastructure they use); it does not itself monitor your internal endpoints, identities, or email — those are the jobs of the other Defender products it complements.

Reflection Question: Why is knowing that a suspicious IP address is linked to a previously identified threat actor more useful to an analyst than simply knowing the IP address was involved in one isolated suspicious connection?