This video describes the architecture
of Microsoft Defender Advanced Threat Protection
so you can better understand how Microsoft delivers
this service to customers.
Built on the Microsoft Azure cloud,
every customer gets a dedicated Microsoft Defender ATP
tenanteach isolated from every other tenant.
Of course, that means customers data is isolated and secured
within their tenants.
That data is only accessible by customers
through Azure Active Directory authentication,
and access is audited.
Within each tenant is a rich behavioral
indicators-of-attack, or IOA dictionary.
This includes heuristics, behavioral rules,
machine learning, and anomaly detection algorithms
that detect suspicious, attack-related events
in the sensor data.
Further, Microsoft Defender ATP uses
big-data, machine-learning, our unique optics into the Windows
ecosystem, and the Intelligent Security Graph
to translate behavioral signals into actionable insight,
detections, and recommended actions.
And when turned on, our built-in automation
runs when the service generates alerts,
starting automated threat investigations
and remediations.
Last, part of customers tenants is a detonation chamber
for deep file analysis.
This is a sandbox where security teams
can upload suspicious files and get a readable report back.
This is an incredibly powerful yet safe way
to investigate potential threats.
Security teams use the Microsoft Defender Security Center
to access their Microsoft Defender ATP data
and to interact with endpoints.
They might investigate potential threats, respond to a breach,
or improve their security postures.
Its where the security analysis happens.
The console provides dashboards, a variety of reports,
and different views of individual entities.
And security analysts can quickly pivot from one data
point to another.
On top of data visualization, it provides security teams
a rich toolset for their incident investigations,
like advanced hunting, live response,
and many other response actions.
The Microsoft Defender ATP sensors
gather security-related events from onboarded endpoints
and send those events to customers tenants.
The only thing needed is an internet connection,
so the service supports almost every conceivable scenario
for company-owned devices.
Security teams can also trigger endpoints to perform actions
like collecting suspicious sample files,
isolating from the network, or running a full AV scan.
All Microsoft Defender ATP security
controls on the endpoint generate valuable security
events.
Those include threat and vulnerability management,
next-generation protection, attack surface reduction,
the EDR sensors, and many moreas well as the update service.
However, security teams must turn on
and configure some of these controls
before they start generating events.
Customers can use that near real-time data
for visibility, reporting, investigation, and threat
hunting.
Additionally, the service uses that sensor data
for correlation, breach detection, visibility,
security analytics, and signal exchange with other Microsoft
Threat Protection services.
Microsoft Defender ATP is a key component
of Microsoft Threat Protection, which
combines other Microsoft security services like Azure
ATP, Office 365 ATP, and Microsoft Cloud App Security
to provide an integrated experience.
Additional integrations with Azure Sentinel, Azure Security
Center, Microsoft Information Protection,
and Microsoft Endpoint Manager enable new scenarios
for our customers.
Aside from those, customers can also
integrate Microsoft Defender ATP with existing security
infrastructures by using our rich set of APIs.
For example, they can connect their SIEM or ticketing systems
to our service or enable their own custom security workflows.
Customers can even add their own Threat Intelligence
by using the API or the console itself.
Key architectural components of Microsoft Defender ATP
are the Security Center console; endpoint sensors;
and customers isolated and secure Microsoft Defender ATP
tenants.
To learn more about the services architecture,
see our documentation on Microsoft Docs.