Skip to content

Commit 1c94d31

Browse files
authored
Update move-to-defender.md
1 parent adfe23d commit 1c94d31

File tree

1 file changed

+6
-7
lines changed

1 file changed

+6
-7
lines changed

articles/sentinel/move-to-defender.md

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -258,17 +258,16 @@ Most functionalities of User and Entity Behavior Analytics (UEBA) remain the sam
258258

259259
### Update investigation processes to use Microsoft Defender threat intelligence
260260

261-
For Microsoft Sentinel customers moving from the Azure portal to the Defender portal, the familiar threat intelligence features are retained and enhanced with Defender's extensive threat intelligence capabilities, including:
262-
<!--are these XDR only features or do they come w sentinel only too? if they come w sentinel only should they move to the usx docset? last one only comes with TI?-->
261+
For Microsoft Sentinel customers moving from the Azure portal to the Defender portal, the familiar threat intelligence features are retained and enhanced with other threat intelligence features available in the Defender portal. Supported features depend on the licenses you have, such as:
263262

264263
| Feature | Description |
265264
|-------------------|------------|
266-
| **Threat analytics** | An in-product solution provided by Microsoft security researchers, designed to help security teams by offering insights on emerging threats, active threats, and their impacts. The data is presented in an intuitive dashboard with cards, rows of data, filters, and more. |
267-
| **Intel Profiles** | Categorize threats and behaviors by a Threat Actor Profile, making it easier to track and correlate. These profiles include any Indicators of Compromise (IoC) related to tactics, techniques, and tools used in attacks. |
268-
| **Intel Explorer** | Consolidates available IoCs and provides threat-related articles as they are posted, enabling security teams to stay updated on emerging threats. |
269-
| **Intel Projects** | Allows teams to consolidate threat intelligence into a 'project' for reviewing all artifacts related to a specific scenario of interest. |
265+
| **Threat analytics** | Supported for [Microsoft Defender XDR](/defender-xdr/) customers. An in-product solution provided by Microsoft security researchers, designed to help security teams by offering insights on emerging threats, active threats, and their impacts. The data is presented in an intuitive dashboard with cards, rows of data, filters, and more. |
266+
| **Intel Profiles** | Supported for [Microsoft Defender Threat Intelligence](/defender/threat-intelligence/) customers. Categorize threats and behaviors by a Threat Actor Profile, making it easier to track and correlate. These profiles include any Indicators of Compromise (IoC) related to tactics, techniques, and tools used in attacks. |
267+
| **Intel Explorer** | Supported for [Microsoft Defender Threat Intelligence](/defender/threat-intelligence/) customers. Consolidates available IoCs and provides threat-related articles as they are posted, enabling security teams to stay updated on emerging threats. |
268+
| **Intel Projects** | Supported for [Microsoft Defender Threat Intelligence](/defender/threat-intelligence/) customers. Allows teams to consolidate threat intelligence into a 'project' for reviewing all artifacts related to a specific scenario of interest. |
270269

271-
In the Defender portal, use the `ThreatIntelOjbects` and `ThreatIntelIndicators` together with Indicators or Compromise for threat hunting, incident response, Copilot, reporting, and to create relational graphs showing connections between indicators and entities.
270+
In the Defender portal, use the `ThreatIntelOjbects` and `ThreatIntelIndicators` together with Indicators for Compromise for threat hunting, incident response, Copilot, reporting, and to create relational graphs showing connections between indicators and entities.
272271

273272
For customers using the Microsoft Defender Threat Intelligence (MDTI) feed, a free version is available via Microsoft Sentinel's data connector for MDTI. Users with MDTI licenses can also ingest MDTI data and use Security Copilot for threat analysis, active threat review, and threat actor research.
274273

0 commit comments

Comments
 (0)