Merge pull request #1293 from MicrosoftDocs/main

aditisrivastava07 · web-flow · commit 4569cf33f761 · 2024-09-09T11:00:27.000+05:30
Publish main to live 09/09/2024, 11:00 AM IST
diff --git a/defender/threat-intelligence/TOC.yml b/defender/threat-intelligence/TOC.yml
@@ -31,6 +31,9 @@
     href: using-projects.md
   - name: Using Microsoft Copilot in Defender for threat intelligence
     href: using-copilot-threat-intelligence-defender-xdr.md
+  - name: Enabling data connector for Defender TI in Microsoft Sentinel (Preview)
+    href: /azure/sentinel/connect-mdti-data-connector
+
 - name: Tutorials
   items:
   - name: Gathering threat intelligence and infrastructure chaining
diff --git a/defender/threat-intelligence/analyst-insights.md b/defender/threat-intelligence/analyst-insights.md
@@ -12,8 +12,8 @@ ms.custom: template-overview
 
 # Analyst insights
 
->[!IMPORTANT]
-> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) will be retired and will no longer be accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
+>[!IMPORTANT] 
+> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) was retired and is no longer accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
 
 In Microsoft Defender Threat Intelligence (Defender TI), the **Analyst insights** section provides you with quick insights about an artifact that might help determine your next step in an investigation. This section lists any insights that apply to the artifact, and insights that don't apply for extra visibility. 
 
diff --git a/defender/threat-intelligence/data-sets.md b/defender/threat-intelligence/data-sets.md
@@ -12,8 +12,8 @@ ms.custom: template-concept
 
 # Data sets
 
-> [!IMPORTANT]
-> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal <https://ti.defender.microsoft.com> will be retired and will no longer be accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
+>[!IMPORTANT] 
+> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) was retired and is no longer accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
 
 Microsoft centralizes numerous data sets into Microsoft Defender Threat Intelligence (Defender TI), making it easier for Microsoft's customers and community to conduct infrastructure analysis. Microsoft's primary focus is to provide as much data as possible about internet infrastructure to support various security use cases.
 
diff --git a/defender/threat-intelligence/gathering-threat-intelligence-and-infrastructure-chaining.md b/defender/threat-intelligence/gathering-threat-intelligence-and-infrastructure-chaining.md
@@ -13,8 +13,8 @@ ms.custom: template-tutorial
 
 # Tutorial: Gathering threat intelligence and infrastructure chaining
 
->[!IMPORTANT]
-> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) will be retired and will no longer be accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
+>[!IMPORTANT] 
+> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) was retired and is no longer accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
 
 
 This tutorial walks you through how to perform several types of indicator searches and gather threat and adversary intelligence using Microsoft Defender Threat Intelligence (Defender TI) in the Microsoft Defender portal.
diff --git a/defender/threat-intelligence/gathering-vulnerability-intelligence.md b/defender/threat-intelligence/gathering-vulnerability-intelligence.md
@@ -12,8 +12,8 @@ ms.custom: template-tutorial
 
 # Tutorial: Gathering vulnerability intelligence
 
->[!IMPORTANT]
-> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) will be retired and will no longer be accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
+>[!IMPORTANT] 
+> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) was retired and is no longer accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
 
 
 This tutorial walks you through how to perform several types of indicator searches to gather vulnerability intelligence using Microsoft Defender Threat Intelligence (Defender TI) in the Microsoft Defender portal.
diff --git a/defender/threat-intelligence/infrastructure-chaining.md b/defender/threat-intelligence/infrastructure-chaining.md
@@ -11,8 +11,9 @@ ms.custom: template-concept
 ---
 
 # Infrastructure chaining
->[!IMPORTANT]
-> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) will be retired and will no longer be accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
+
+>[!IMPORTANT] 
+> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) was retired and is no longer accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
 
 Infrastructure chaining uses the relationships between highly connected datasets to build out an investigation. This process is the core of threat infrastructure analysis and allows organizations to surface new connections, group similar attack activity and substantiate assumptions during incident response.
 
diff --git a/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal.md b/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal.md
@@ -1,6 +1,6 @@
 --- 
 title: 'Quickstart: Accessing Microsoft Defender Threat Intelligence (Defender TI)'
-description: In this quickstart, learn how to access Microsoft Defender Threat Intelligence (Defender TI) in the Microsoft Defender portal, as well as configure your profile and preferences and access help resources in the Defender portal.
+description: Learn how to access Microsoft Defender Threat Intelligence (Defender TI) in the Microsoft Defender portal, configure your profile and preferences, and access help resources.
 author: alexroland24
 ms.author: aroland
 manager: dolmont
@@ -14,11 +14,11 @@ ms.collection: essentials-get-started
 # Quickstart: Learn how to access Microsoft Defender Threat Intelligence and make customizations
 
 >[!IMPORTANT] 
-> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) will be retired and will no longer be accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
+> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) was retired and is no longer accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
 
 This guide walks you through how to access Microsoft Threat Intelligence (Defender TI) from the Microsoft Defender portal, adjust the portal's theme to make it easier on your eyes when using it, and find sources for enrichment so you can see more results when gathering threat intelligence. 
 
-   :::image type="content" source="/defender/threat-intelligence/media/quickstart-intel-explorer.png" alt-text="Screenshot of the Microsoft Defender Threat Intelligence Intel explorer in the Microsoft Defender portal." lightbox="/defender/threat-intelligence/media/quickstart-intel-explorer.png":::
+:::image type="content" source="/defender/threat-intelligence/media/quickstart-intel-explorer.png" alt-text="Screenshot of the Microsoft Defender Threat Intelligence Intel explorer in the Microsoft Defender portal." lightbox="/defender/threat-intelligence/media/quickstart-intel-explorer.png":::
 
 ## Prerequisites
 
@@ -37,6 +37,7 @@ This guide walks you through how to access Microsoft Threat Intelligence (Defend
    - Intel projects
 
     :::image type="content" source="/defender/threat-intelligence/media/quickstart-navigation.png" alt-text="Screenshot of the Microsoft Defender portal with the Threat intelligence navigation  links highlighted." lightbox="/defender/threat-intelligence/media/quickstart-navigation.png":::
+
 ## Adjust the Defender portal's display theme to dark or light mode
 
 By default, the Defender portal's display theme is set to light mode. To switch to dark mode, on the Defender portal, navigate to **Home** then select **Dark mode** on the upper right-right corner of the home page.
@@ -47,6 +48,26 @@ To switch back to light mode, select **Light mode** in the same upper-right hand
 
 ![Partial screenshot of the Defender portal home page with the Light mode icon hightlighted.](media/quickstart-light-mode.png)
 
+## Catch up on the latest threat intelligence
+
+You can keep yourself updated with the latest and most notable threat intelligence articles through the **Featured threat intelligence article** widget or through the article digest notifications.
+
+### Featured threat intelligence articles widget
+
+The **Featured threat intelligence articles** widget in the Defender portal home page displays the recent Defender TI publications that are tagged as [Featured articles](what-is-microsoft-defender-threat-intelligence-defender-ti.md#featured-articles):
+
+:::image type="content" source="/defender/threat-intelligence/media/mdti-featured-articles-widget.png" alt-text="Screenshot of Featured threat intelligence articles widget in the Defender portal home page." lightbox="/defender/threat-intelligence/media/mdti-featured-articles-widget.png":::
+
+### Article digest 
+
+In the **Intel explorer** page, a banner message notifies you of the number of new Defender TI articles that were published since you last accessed the Defender portal. Select **Show me** to open a flyout panel that lists the articles you might have missed, then select any of the listed articles to open it:
+
+:::image type="content" source="/defender/threat-intelligence/media/mdti-article-digest-01.png" alt-text="Screenshot of the Intel explorer article digest banner message notification and flyout panel." lightbox="/defender/threat-intelligence/media/mdti-article-digest-01.png":::
+
+Select the **Clear** button in the flyout panel or close the banner message to clear the article digest:
+
+
+:::image type="content" source="/defender/threat-intelligence/media/mdti-article-digest-02.png" alt-text="Screenshot of the Intel explorer article digest flyout panel with the Clear button highlighted." lightbox="/defender/threat-intelligence/media/mdti-article-digest-02.png":::
 
 ## Get help and learn about Defender TI support resources
 
diff --git a/defender/threat-intelligence/media/mdti-article-digest-01.png b/defender/threat-intelligence/media/mdti-article-digest-01.png
diff --git a/defender/threat-intelligence/media/mdti-article-digest-02.png b/defender/threat-intelligence/media/mdti-article-digest-02.png
diff --git a/defender/threat-intelligence/media/mdti-featured-articles-widget.png b/defender/threat-intelligence/media/mdti-featured-articles-widget.png
diff --git a/defender/threat-intelligence/reputation-scoring.md b/defender/threat-intelligence/reputation-scoring.md
@@ -12,8 +12,8 @@ ms.custom: template-overview
 
 # Reputation scoring
 
->[!IMPORTANT]
-> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) will be retired and will no longer be accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
+>[!IMPORTANT] 
+> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) was retired and is no longer accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
 
 Microsoft Defender Threat Intelligence (Defender TI) provides proprietary reputation scores for any host, domain, or IP address. Whether validating the reputation of a known or unknown entity, this score helps you quickly understand any detected ties to malicious or suspicious infrastructure. Defender TI provides quick information about the activity of these entities (for example, first- and last-seen timestamps, autonomous system numbers, and associated infrastructure) and a list of rules that affect the reputation score when applicable.
 
diff --git a/defender/threat-intelligence/searching-and-pivoting.md b/defender/threat-intelligence/searching-and-pivoting.md
@@ -12,8 +12,8 @@ ms.custom: template-how-to
 
 # Searching and pivoting
 
->[!IMPORTANT]
-> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) will be retired and will no longer be accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
+>[!IMPORTANT] 
+> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) was retired and is no longer accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
 
 Microsoft Defender Threat Intelligence (Defender TI) offers a robust and flexible search engine to streamline the investigation process. Defender TI is designed to let you pivot across various indicators from different data sources, making it easier than ever to discover relationships between disparate infrastructure. 
 
diff --git a/defender/threat-intelligence/security-copilot-and-defender-threat-intelligence.md b/defender/threat-intelligence/security-copilot-and-defender-threat-intelligence.md
@@ -17,8 +17,8 @@ ms.date: 12/04/2023
 
 # Microsoft Copilot for Security and Microsoft Defender Threat Intelligence
 
-> [!IMPORTANT]
-> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) will be retired and will no longer be accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
+>[!IMPORTANT] 
+> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) was retired and is no longer accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
 
 Microsoft Copilot for Security is a cloud-based AI platform that provides natural language copilot experience. It can help support security professionals in different scenarios, like incident response, threat hunting, and intelligence gathering. For more information about what it can do, read [What is Microsoft Copilot for Security?](/security-copilot/microsoft-security-copilot).
 
diff --git a/defender/threat-intelligence/sorting-filtering-and-downloading-data.md b/defender/threat-intelligence/sorting-filtering-and-downloading-data.md
@@ -13,7 +13,7 @@ ms.custom: template-how-to
 # Sorting, filtering, and downloading data
 
 >[!IMPORTANT] 
-> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) will be retired and will no longer be accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
+> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) was retired and is no longer accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
 
 Microsoft Defender Threat Intelligence (Defender TI) lets you access our vast collection of crawling data in an indexed and pivot table format. These data sets can be large, returning expansive amounts of historic and recent data. By letting you appropriately sort and filter the data, we help you surface the connections of interest easily.
 
diff --git a/defender/threat-intelligence/using-copilot-threat-intelligence-defender-xdr.md b/defender/threat-intelligence/using-copilot-threat-intelligence-defender-xdr.md
@@ -20,8 +20,8 @@ ms.date: 04/01/2024
 **Applies to:**
 - [Microsoft Defender XDR](/defender-xdr)
 
-> [!IMPORTANT]
-> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) will be retired and will no longer be accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
+>[!IMPORTANT] 
+> On June 30, 2024, The Microsoft Defender Threat Intelligence (Defender TI) standalone portal (https://ti.defender.microsoft.com) was retired and is no longer accessible. Customers can continue using Defender TI in the [Microsoft Defender portal](https://aka.ms/mdti-intel-explorer) or with [Microsoft Copilot for Security](security-copilot-and-defender-threat-intelligence.md). [Learn more](https://aka.ms/mdti-standaloneportal)
 
 Microsoft Copilot in Defender applies the capabilities of [Microsoft Copilot for Security](/security-copilot/microsoft-security-copilot) to deliver Microsoft Defender Threat Intelligence (Defender TI) information about threat actors and tools, as well as contextual threat intelligence, directly into the Microsoft Defender portal. Based on threat analytics reports, intel profiles, and other available Defender TI content, you can use Copilot in Defender to summarize the latest threats affecting your organization, know which threats to prioritize based on your exposure level, or gain more knowledge about your organization's or the global threat landscape.
 
diff --git a/defender/threat-intelligence/using-projects.md b/defender/threat-intelligence/using-projects.md
diff --git a/defender/threat-intelligence/using-tags.md b/defender/threat-intelligence/using-tags.md
diff --git a/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti.md b/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti.md
