MDE features
MDE is part of the Microsoft 365 Defender suite of security products. It provides full Endpoint Detection and Response (EDR) capabilities with a focus on protecting connected endpoints. When combined, the M365 Defender suite protects four domains (application, identity, endpoint, and data), allowing threat signals to be viewed holistically by adding context that paints a clearer picture of the security threat. For example, Microsoft Defender for Office (MDO) can alert when a user clicks on a phishing link in an email. This threat can then be correlated and investigated in MDE by looking at the device event timeline, using advanced hunting, or reviewing any relevant alerts to understand the potential impact. Security teams can easily add any malicious domains that have been identified to the IOC list, thus blocking connections from the endpoints and automatically purge emails targeting other users using MDO. By analyzing near-real-time telemetry data, MDE can further correlate...
