4.4.7. Microsoft Threat Intelligence

💡 First Principle: Microsoft Threat Intelligence (formerly Microsoft Defender Threat Intelligence, or Defender TI) aggregates external data about attacker infrastructure, tactics, and indicators of compromise (IOCs) — malicious IP addresses, domains, file hashes — giving analysts outside context about who might be behind an attack and what else that attacker's infrastructure has been used for, beyond what's visible inside your own environment alone.

This external context helps analysts move from "we detected a suspicious connection to this IP" to "this IP is known infrastructure associated with a specific tracked threat actor known for targeting this industry" — informing both the urgency of the response and what else to watch for.

It is built into the Microsoft Defender portal: intel profiles on threat actors and their tools, the Intelligence explorer for searching indicators, threat analytics reports on active campaigns, and threat-intelligence enrichment on the entity pages analysts already use during an investigation. Its public data is included for Defender XDR customers. (The old standalone threat intelligence portal was retired on 1 August 2026, so older study material that describes a separate portal is out of date.)

⚠️ Exam Trap: Microsoft Threat Intelligence provides external threat context (who's attacking, what infrastructure they use); it does not itself monitor your internal endpoints, identities, or email — those are the jobs of the other Defender products it complements.

Reflection Question: Why is knowing that a suspicious IP address is linked to a previously identified threat actor more useful to an analyst than simply knowing the IP address was involved in one isolated suspicious connection?