[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDZaM5yG-D-X94Ts8ph-JoJI20VT94ud4BUqO9FJi-8Q":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":108},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"ba400d19-565b-4f3b-81cb-42021df23350","Turning threat intelligence into decisive action with Defender Experts","turning-threat-intelligence-into-decisive-action-with-defender-experts-8ed526","Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints, identities, cloud workloads, and a sprawling mix of third-party tools. The post Turning threat intelligence into decisive action with Defender Experts appeared first on Microsoft Security Blog.","Microsoft has introduced Microsoft Defender Experts Threat Intelligence, a new service designed to help organizations bridge the gap between receiving threat intelligence and taking action. This human-led offering provides curated insights tailored to an organization's specific industry and environment, delivered by designated Microsoft experts. Additionally, Microsoft is expanding its Defender Experts Managed Detection and Response (MDR) service to include broader third-party and multi-cloud coverage.","Microsoft launches Defender Experts Threat Intelligence and expands Defender Experts MDR.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F07\u002F15\u002Fturning-threat-intelligence-into-decisive-action-with-defender-experts\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002FMS_Actional-Insights_Lock.jpg","2026-07-15T16:00:35+00:00","2026-07-15T18:00:10.504716+00:00",7,[17,20,22,24],{"name":18,"type":19},"Microsoft Defender Experts Threat Intelligence","product",{"name":21,"type":19},"Microsoft Defender Experts MDR",{"name":23,"type":19},"Microsoft Defender Threat Intelligence",{"name":25,"type":26},"Microsoft","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":27,"icon":29,"name":30,"slug":31},null,"Threat Intelligence","threat-intelligence",[33,38],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},[],[25,18,21],{"controls":43,"vendors":102},[44,73],{"slug":45,"name":46,"problem":47,"products":48},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[49,57,65],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"slug":74,"name":75,"problem":76,"products":77},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","managed-detection-and-response","ThreatLocker MDR","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fmanaged-detection-and-response","24\u002F7 monitoring by ThreatLocker's Cyber Hero team, which verifies alerts, isolates devices and stops attacks before they spread.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-mdr","Sophos MDR","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fservices\u002Fmanaged-detection-and-response","Managed detection and response, 24\u002F7, including for other vendors' tools.",[103],{"slug":104,"name":25,"logo_path":105,"roles":106},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[107],"reported_by",{"slug":109,"title":110,"body":111,"framework_refs":112,"framework_notes":121},"bridging-the-gap-between-threat-intelligence-and-decisive-action","Bridging the Gap Between Threat Intelligence and Decisive Action","Many organizations struggle to operationalize threat intelligence, leaving a dangerous gap between knowing about threats and acting on them. Without dedicated expertise to contextualize and prioritize intelligence, teams are often overwhelmed by raw data and fail to respond before threats materialize. Microsoft's Defender Experts service highlights a growing industry need: human-led analysis that translates generic threat feeds into environment-specific, actionable guidance. This matters because delayed or uninformed responses to credible threats dramatically increase the likelihood of successful breaches. Organizations relying solely on automated tools without expert interpretation risk missing the nuanced, targeted attacks most relevant to their sector.",[113,114,115,116,117,118,119,120],"NIST SP 800-61 Rev. 2 – Incident Response","NIST SP 800-150 – Cyber Threat Intelligence Sharing","CIS Control 17 – Incident Response Management","CIS Control 7 – Continuous Vulnerability Management","MITRE ATT&CK – Threat Intelligence Integration","ISO\u002FIEC 27035 – Information Security Incident Management","NIST CSF DE.AE – Anomalies and Events Detection","NIST CSF RS.AN – Response Analysis",{}]