Microsoft Defender XDR (formerly Microsoft 365 Defender) is an extended detection and response solution that provides unified visibility, investigation, and response capabilities across endpoints, identities, email, collaboration tools, SaaS applications, cloud workloads, and data. The platform correlates security signals at the incident level to provide a complete view of the cyberattack chain. It automatically disrupts in-progress attacks by analyzing attacker intent, identifying compromised assets, and containing them in real time through its attack disruption capability. The solution includes automated investigation and response features that can auto-heal affected assets and handle recurring alerts using custom detection rules with Kusto Query Language. It prioritizes incidents to reduce alert fatigue and enable security operations teams to focus on critical threats. Microsoft Defender XDR incorporates Microsoft Security Copilot for AI-assisted threat response, allowing analysts to build natural language queries, reverse engineer adversarial scripts, and receive AI-guided remediation actions. The platform supports advanced threat hunting capabilities with custom query creation across XDR data sources. The solution provides protection across multiple attack surfaces including endpoint and network devices, hybrid identities, email and collaboration tools, and SaaS applications. It offers multitenant management capabilities for managed service providers and organizations with complex environments.