Unify Threat Detection with Microsoft Defender XDR

Microsoft Defender XDR unifies threat detection and response across endpoints, email, identity, and cloud applications into a single incident queue. This course covers the full platform — from understanding how alerts correlate into incidents, to investigating attack chains that span multiple workloads, to configuring automated response actions that contain threats before analysts even see them.

You will work in the unified security portal, investigating real attack scenarios that touch multiple Defender products. An identity compromise that leads to email exfiltration, a phishing attack that delivers malware to an endpoint, a cloud app credential theft that triggers impossible travel detection — these are the multi-stage attacks that XDR is designed to catch, and this course teaches you to investigate and respond to them.

Advanced hunting with KQL is a major focus. You will write cross-workload queries that join endpoint telemetry with identity events and email metadata. This is where XDR delivers value that individual products cannot — the ability to see an entire attack chain from initial access to data exfiltration in a single query.