Trace Id is missing
Skip to main content
Microsoft Security

Explore the latest in AI-powered cybersecurity capabilities announced at Microsoft Secure.  Watch on demand >  Read the announcement >

Microsoft Defender Threat Intelligence

Unmask and neutralize modern adversaries and cyberthreats such as ransomware.

Contact Sales to start a free trial or explore licensing options.
Three people working together at a desk.

Uncover your adversaries

Expose and eliminate modern cyberthreats and their infrastructure using dynamic threat intelligence.

Identify cyberattackers and their tools

Understand your adversaries and their online infrastructures to identify your potential cyberthreat exposures using a complete map of the internet.

Accelerate cyberthreat detection and remediation

Discover the full scope of a cyberattack. Understand an online adversary’s entire toolkit, prevent access by all their machines and known entities, and continuously block IP addresses or domains.

Enhance your security tools and workflows

Extend the reach and visibility of your existing security investments. Gain more context and understanding of cyberthreats by using powerful, raw threat intelligence from your security tools.

Microsoft Defender Threat Intelligence

Learn how Defender Threat Intelligence enables security professionals to directly access, ingest, and act upon our powerful repository of threat intelligence built from 65 trillion signals and over 10,000 multidisciplinary experts worldwide.

Capabilities

Uncover and help eliminate cyberthreats with Defender Threat Intelligence. 

A list of components on hosts in Microsoft Defender Threat Intelligence.

Get continuous cyberthreat intelligence

Get a complete view of the internet and track day-to-day changes. Create threat intelligence for your own business to understand and reduce exposure.

A document titled Risk IQ: Fingerprinting Sliver C2 Servers in Microsoft Defender Threat Intelligence.

Expose adversaries and their methods

Understand the group behind an online cyberattack, their methods, and how they typically operate.

An Incidents list in Microsoft Sentinel organized by severity.

Enhance alert investigations

Enrich Microsoft Sentinel and Microsoft Defender XDR incident data with finished and raw threat intelligence to understand and uncover the full scale of a cyberthreat or cyberattack.

A list of Host Pairs for a website in Microsoft Defender Threat Intelligence.

Accelerate incident response

Investigate and remove malicious infrastructure such as domains and IPs and all the known tools and resources operated by a cyberattacker or cyberthreat family.

A project named Franken-Phish and a list of related artifacts in Microsoft Defender Threat Intelligence.

Hunt cyberthreats as a team

Easily collaborate on investigations across teams using the Defender Threat Intelligence workbench and share knowledge of cyberthreat actors, tooling, and infrastructure with Intel Profiles.

A list of components on IPs on Microsoft Defender Threat Intelligence.

Expand prevention and improve security posture

Automatically uncover malicious entities and help stop outside cyberthreats by blocking internal resources from accessing dangerous internet resources.

Back to tabs

Discover new integrations with Microsoft Security Copilot

Use natural language queries to summarize investigations and explore built-in threat intelligence with Microsoft Security Copilot, now in early access.

How Microsoft Defender Threat Intelligence works

Microsoft tracks more than 65 trillion signals daily, helping security teams identify vulnerabilities with greater efficacy and stay ahead of today's cyberthreats.

A diagram showing how Defender Threat Intelligence works through advanced internet reconnaissance, analysis, and dynamic cyberthreat intelligence.

Unified security operations platform

Secure your digital estate with the only security operations (SecOps) platform that unifies the full capabilities of extended detection and response (XDR) and security information and event management (SIEM).

Animation of microsoft defender dashboard homepage

Unified portal

Detect and disrupt cyberthreats in near real time and streamline investigation and response.

Back to tabs

Explore Defender Threat Intelligence licenses

Defender Threat Intelligence—free version

Use the free version of Defender Threat Intelligence to address global cyberthreats.

  • Free version includes:

  • Public indicators of compromise (IOCs)

  • Open-source intelligence (OSINT)

  • Common vulnerabilities and exposures (CVEs) database

  • Articles and analysis from Microsoft Threat Intelligence (limited1)

  • Defender Threat Intelligence datasets (limited2)

  • Intelligence Profiles (limited3)

Defender Threat Intelligence—premium version

Get full access to the operational, strategic, and tactical intelligence in the Defender Threat Intelligence content library and investigative workbench. 

  • Premium version includes:

  • Public indicators of compromise (IOCs)

  • Open-source intelligence (OSINT)

  • Common vulnerabilities and exposures (CVEs) database

  • Articles and analysis from Microsoft Threat Intelligence 

  • Defender Threat Intelligence datasets

  • Intelligence Profiles

  • Microsoft IOCs

  • Microsoft-enriched OSINT

  • URL and file intelligence

Related products

Use best-in-class Microsoft security products to help prevent and detect cyberattacks across your organization.

A person having a conversation at their desk.

Microsoft Sentinel

See and stop cyberthreats across your entire enterprise with intelligent security analytics.

A person sitting at their desk typing on a laptop connected to a desktop monitor.

Microsoft Defender for Cloud

Increase protection in your multicloud and hybrid environments.

A person working at their desk across two monitors.

Microsoft Defender External Attack Surface Management

Understand your security posture beyond the firewall.

Additional resources

Announcement

Read the cyberthreat intelligence blog

Learn about the new cyberthreat intelligence offerings from Microsoft.

Infographic

Help protect your business with cyberthreat intelligence

Learn how to use internet threat intelligence to protect your organization against cyberattacks.

Documentation

Best practices and implementation

Get started with cyberthreat intelligence solutions for your organization today.

Blog

Visit the Microsoft Defender Threat Intelligence blog

Learn from Defender Threat Intelligence experts, see what's new, and let us hear from you.

Protect everything

Make your future more secure. Explore your security options today.

  • [1] Get OSINT and access select featured articles.
  • [2] Get the most recent two weeks of select datasets.
  • [3] Preview select Intel Profiles.

Follow Microsoft